Patent Description:
A vehicle is equipped with a network system configured such that a plurality of in-vehicle devices called electronic control units (ECUs) is connected to each other via a communication line. Each of the in-vehicle devices transmits and receives a message to and from the other in-vehicle devices so as to share and execute functions of the vehicle.

The in-vehicle devices typically include a processor and a transitory storage unit such as random access memory (RAM) or a non-volatile storage unit such as flash read-only memory (ROM). A program (software) executed by the processor is stored in the non-volatile storage unit. Rewriting and updating of the program to a newer version makes it possible to upgrade and improve functions of the in-vehicle device.

Updating of the program involves a step of downloading in which update data is received from an external device (a center) via a wireless communication, etc., and a step of installation in which an update program (update software) is written in the storage unit of the in-vehicle device based on the downloaded update data. There are two types of installation of the program, that is, an overwriting installation and a second side installation, depending on the specification of the in-vehicle device. The overwriting installation is an installation in which the update program is written in one region (single side) that is determined as a region for storing the program from the entire memory region of the storage unit. The second side installation is an installation in which, of two regions (double sides) that are determined as regions for storing the program, the downloaded update program is written into one of the regions (second side) that is not a region (first side) in which the current program (previous program) is stored.

In the case of the second side installation, the step of updating program involves an activation step of configurating a set value such as a start address of the update program such that the installed update program becomes executable, in addition to the steps of downloading and installation.

<CIT>describes an on-board update system, an on-board update apparatus, an on-board device, and an update method, updates the on-board device without limiting the use of the vehicle for the convenience of the user. An on-board update system for updating a program or data stored in a storage unit of an on-board device transmits an update program or data stored in an update storage unit to the on-board device, and interrupts the transmission of the update program or data to the on-board device depending on the circumstances around a vehicle. The on-board device includes, in its storage unit, a first storage region in which a pre-update program or data is stored and a second storage region configured to store an update program or data. The on-board device restores the execution of the pre-update program or data if the transmission of the update program or data is interrupted. <CIT> describes updating of the control program of a vehicle-mounted control device. This control device comprises: an acquisition unit that acquires the detection information of a sensor capable of ascertaining the presence or absence of a person in the vehicle; and a determination unit that determines whether to update the control program on the basis of the detection information.

In relation to the program update of the ECU, <CIT> (<CIT>) discloses a technology that a specific ECU functions as a master ECU, communicates with a server, and updates the program of the master ECU and other slave ECUs.

On the other hand, in vehicles, a service that uses a mobile terminal device such as a smartphone as an electronic key has been proposed. In the service above, for example, the vehicle authenticates the mobile terminal device as the electronic key via wireless communication, and permits a user holding the mobile terminal device to perform operations such as unlocking and locking of the door. <CIT> (<CIT>) discloses that in a car sharing system in which a plurality of users shares one vehicle, a mobile terminal device such as a smartphone held by each user is provided with a function as the electronic key.

It is conceivable to use the mobile terminal device such as a smartphone as a user interface for receiving a user command related to program update of the in-vehicle device. In this case, there is a room for improvement in execution of authority management in consideration of security.

The present disclosure provides a software update device, a software update method, and a center that suitably grant a mobile terminal device an authority as a user interface for program update processing of the in-vehicle device.

A software update device according to an aspect of the present disclosure is defined in appended claim <NUM>.

A software update method according to a second aspect of the present disclosure is defined in appended claim <NUM>.

A center according a third aspect of the present disclosure is defined in appended claim <NUM>.

According to the present disclosed technology, the mobile terminal device is granted the authority as the user interface for the update processing based on that the vehicle authenticates the mobile terminal device as the electronic key and the predetermined operation to the vehicle is actually performed using the mobile terminal device as the electronic key. This makes it possible to preferably guarantee a reliability of the mobile terminal device as the user interface.

<FIG> shows a configuration example of a network system <NUM> according to an embodiment. The network system <NUM> is mounted on a vehicle. The network system <NUM> includes a software update device (over-the-air (OTA) master) <NUM>. A plurality of buses <NUM>, <NUM>, <NUM>,. is connected to the software update device <NUM>. A plurality of in-vehicle devices (electronic control units) <NUM>, <NUM>,. is connected to the bus <NUM>. A plurality of in-vehicle devices <NUM>, <NUM>. is connected to the bus <NUM>. A plurality of actuators <NUM>, <NUM>. is connected to the bus <NUM>. In <FIG> and the following description, the buses <NUM>, <NUM>, <NUM> are exemplified as the buses, the in-vehicle devices <NUM>, <NUM>, <NUM>, <NUM> are exemplified as the in-vehicle devices, and the actuators <NUM>, <NUM> are exemplified. However, the numbers of the buses, the in-vehicle devices, and the actuators are not limited.

The software update device <NUM> includes a communication unit (communication module) <NUM> that is communicable with an external device (center) <NUM> provided outside of the vehicle and a mobile terminal device <NUM>, and a first control unit <NUM> and a second control unit <NUM> that control update of programs of the in-vehicle devices <NUM>, <NUM>, <NUM>, <NUM> based on update data provided by the external device <NUM>. The software update device <NUM> is typically a computer including a non-volatile storage unit (storage) <NUM> such as a flash ROM, a control unit (one or more processors) that executes various types of processing by reading the program (software) from the non-volatile memory <NUM> and executing the program, and a transitory storage unit that stores a part of the program and data, such as a RAM. The software update device <NUM> controls and relays communication between the external device <NUM> and the in-vehicle devices <NUM>, <NUM>, <NUM>, <NUM>, communication among the in-vehicle devices <NUM>, <NUM>, <NUM>, <NUM>, communication between the in-vehicle devices <NUM>, <NUM>, <NUM>, <NUM> and the actuators <NUM>, <NUM>, via the buses <NUM>, <NUM>, <NUM>. As described above, the software update device <NUM> also functions as a relay device that relays communication.

The in-vehicle devices <NUM>, <NUM>, <NUM>, <NUM> communicate with each other and execute various types of processing for controlling the vehicle. Similar to the software update device, the in-vehicle devices above are typically computers each including a storage unit and a control unit. Similar to the software update device, the external device <NUM> is typically a computer including a storage unit (storage) <NUM>, a control unit (one or more processors) <NUM>, and a communication unit <NUM>, as shown in <FIG>.

The actuators <NUM>, <NUM> are devices that generate mechanical actions with respect to the vehicle and components of the vehicle, such as a brake, an engine, or a power steering device, and operate based on commands from the in-vehicle devices <NUM>, <NUM>, <NUM>, <NUM>.

The first control unit <NUM> of the software update device <NUM> can update the programs stored in the respective storage units (storages) of the in-vehicle devices <NUM>, <NUM>, <NUM>, <NUM>. That is, the software update device <NUM> executes download control or installation control, or further executes activation control of the program. Downloading is processing to receive, from the external device <NUM>, the transmitted update data (distribution package) for updating any of the programs of the in-vehicle devices <NUM>, <NUM>, <NUM>, <NUM> and to store the update data. The download control may include, in addition to execution of downloading, control of a series of processing related to downloading, such as determination as to whether to execute downloading and verification of the update data. Installation is processing to write an update version of the program (update software) in the storage unit of the in-vehicle device to be updated based on the downloaded update data. The installation control may include, in addition to execution of installation, control of a series of processing related to installation, such as determination as to whether to execute installation, transfer of the update data, and verification of the updated version of the program. Activation is processing to validate (activate) the installed updated version of the program. The activation control may include, in addition to execution of activation, control of a series of processing related to activation, such as determination as to whether to execute activation and verification of execution results.

In the installation control, when the update data includes the update program itself, the first control unit <NUM> can transmit the update program to the in-vehicle device. When the update data includes compressed data, difference data, or divided data of the update program, the first control unit <NUM> may generate the update program by decompressing or assembling the update data and transmit the update program to the in-vehicle device. Alternatively, the first control unit <NUM> may transmit the update data to the in-vehicle device, and the in-vehicle device may generate the update program by decompressing or assembling the update data.

The first control unit <NUM> may execute installation to write the update program to a second storage unit of the in-vehicle device, the in-vehicle device that has received a command from the first control unit <NUM> may execute the installation, or the in-vehicle device that has received the update data (or the update program) may autonomously execute the installation without an explicit command from the first control unit <NUM>.

The first control unit <NUM> may execute activation to activate the update program, the in-vehicle device that has received a command from the first control unit <NUM> may execute the activation, or the in-vehicle device may autonomously execute the activation following the installation without an explicit command from the first control unit <NUM>.

Note that, the update processing of the program as described above can be executed continuously or in parallel with respect to the in-vehicle devices. The update data is data used for generating the update program. The content and format of the upload data are not limited. For example, the update data includes the update program itself, difference data for generating the update program, or compressed data or divided data of the update program, etc. Further, the update data may include an identifier (ECU ID) of the in-vehicle device (target electronic control unit) of which program is to be updated and an identifier (WCU software ID) of the version of the program before the update.

The mobile terminal device <NUM> is a mobile computer, such as a smartphone, including a display unit that displays and presents information to the user and an input unit that receives an operation by the user. The mobile terminal device <NUM> functions as an electronic key of the vehicle. An authentication device (not shown) provided in the vehicle communicates with the mobile terminal device to execute a predetermined authentication via short-range wireless communication. When the authentication is successful, various operations to the vehicle are permitted, such as unlocking or locking of the door as the user touches a door handle, for example. With the configuration above, the user who holds the mobile terminal device <NUM> is permitted to perform various operations to the vehicle.

The mobile terminal device <NUM> communicates with the communication unit <NUM> of the software update device <NUM> described above, and transmits and receives information related to updates of the in-vehicle devices <NUM>, <NUM>, <NUM>, <NUM> to be executed by the first control unit <NUM>, and then the software update device <NUM> can display a screen to ask the user for permission of update or receive an input by the user indicating the permission for update, for example. The processing described above including displaying of information related to the program update to be executed by the mobile terminal device <NUM> and reception of the operation by the user is hereinafter referred to as interface processing. The mobile terminal device <NUM> can execute functions according to the present embodiment by executing a predetermined application program, for example, even when the mobile terminal device <NUM> is a general-purpose device.

<FIG> shows a functional block of the second control unit <NUM>. The second control unit <NUM> includes an acquisition unit <NUM> and an authority management unit <NUM>. The acquisition unit <NUM> acquires cooperation information indicating that the user has performed a predetermined operation of the vehicle using the mobile terminal device <NUM> as the electronic key. The authority management unit <NUM> manages whether the mobile terminal device <NUM> is permitted to execute the interface processing. Whether the mobile terminal device <NUM> is permitted to execute the interface processing is determined in accordance with at least the acquisition unit <NUM> acquiring the cooperation information.

The details of the processing according to the embodiment will be described below. <FIG>, <FIG>, and <FIG> are flowcharts and sequence diagrams showing an example of processing in which the authority management unit <NUM> permits the mobile terminal device <NUM> to execute the interface processing. <FIG> is a sequence diagram showing an example of program update processing including the interface processing to be executed by the mobile terminal device <NUM>. Note that the processing above is typically executed in a state where the vehicle is stopped, such as when a power supply is turned off (an ignition is turned off or a power is turned off).

First, with reference to <FIG> and <FIG>, an example of processing in which the second control unit <NUM> of the software update device <NUM> permits the mobile terminal device <NUM> to execute the interface processing will be described.

The mobile terminal device <NUM> performs short-range wireless communication with the authentication device of the vehicle and is authenticated by the authentication device. The authentication device may be provided in the software update device <NUM>, or may be provided separately from the software update device <NUM>.

When the mobile terminal device <NUM> is authenticated, the authentication device generates the cooperation information indicating that the mobile terminal device <NUM> is authenticated. The acquisition unit <NUM> of the second control unit <NUM> acquires the cooperation information. When the user holding the authenticated mobile terminal device <NUM> touches the door handle, for example, the operation such as unlocking and locking of the door is permitted, and the operation is actually executed. As in the example above, the mobile terminal device <NUM> has a function of requesting the vehicle for permission for a part of or the entire vehicle control when the vehicle authenticates the mobile terminal device <NUM>. The authentication device may generate cooperation information when a predetermined vehicle operation is actually executed. As described above, the cooperation information is information indicating that the mobile terminal device <NUM> is functionally connected to the vehicle and is used in cooperation with the vehicle in various operations to the vehicle.

When the acquisition unit <NUM> acquires the cooperation information, the authority management unit <NUM> of the second control unit <NUM> sets the mobile terminal device <NUM> as the mobile terminal device that is permitted for the execution of the interface processing.

In the execution permission processing for the interface processing above, the authority management unit <NUM> may refer to user authority information (to be described later) indicating whether the user is granted an update management authority, and may permit the mobile terminal device <NUM> to execute the interface processing as long as the user is granted the update management authority, in addition to acquisition of the cooperation information.

As in a modified example shown in <FIG>, the external device <NUM> may determine whether to permit execution of the interface processing, and the authority management unit <NUM> may permit execution of the interface processing in accordance with a determination result. In this case, in step S102, the authority management unit <NUM> of the second control unit <NUM> controls the communication unit <NUM> to transmit the cooperation information to the external device <NUM>. Further, the control unit <NUM> of the external device <NUM> that has received the cooperation information controls the communication unit <NUM> to issue a command to the authority management unit <NUM> of the vehicle such that the authority management unit <NUM> sets the mobile terminal device <NUM> as the mobile terminal device that is permitted for execution of the interface processing with respect to the corresponding vehicle. In step S103, the authority management unit <NUM> sets the mobile terminal device <NUM> as the mobile terminal device that is permitted for execution of the interface processing in accordance with the command. In this case, the external device <NUM> may refer to the user authority information to be described later and permit execution of the interface processing only when the user is granted the update management authority, in addition to acquisition of the cooperation information.

Further, as another modification, the mobile terminal device <NUM> may permit the mobile terminal device <NUM> itself to execute the interface processing based on the authentication processing in step S101. In this case, the mobile terminal device <NUM> may refer to the user authority information (to be described later) indicating whether the user is granted the update management authority, and may permit execution of the interface processing as long as the user is granted the update management authority, in addition to execution of the authentication processing.

Next, an example of the program update processing including the interface processing of the mobile terminal device <NUM> will be described with reference to <FIG>.

The first control unit <NUM> of the software update device <NUM> controls the communication unit <NUM> to inquire the external device <NUM> whether there is the update program for the in-vehicle device mounted on the vehicle.

When the communication unit <NUM> receives the inquiry, the control unit <NUM> of the external device <NUM> transmits, to the software update device <NUM>, an update notification indicating that there is the update program. The update program or the update data for generating the update program is stored in, for example, the storage unit <NUM>.

When the communication unit <NUM> receives the update notification, the first control unit <NUM> of the software update device <NUM> controls the communication unit <NUM> to transmit an update permission request to the mobile terminal device <NUM> set as the mobile terminal device that is permitted for execution of the interface processing in step S103 above.

The mobile terminal device <NUM> displays a screen on the display unit to receive an input as to whether the update is permitted.

The mobile terminal device <NUM> receives the input from the user to permit the update.

The mobile terminal device <NUM> transmits, to the software update device <NUM>, an update permission notification indicating that the update is permitted by the user. When the input indicating that the update is not permitted is received from the user in step S205, the mobile terminal device <NUM> transmits, to the software update device <NUM>, an update dismissal notification indicating that the update is not permitted by the user.

When the communication unit <NUM> receives the update permission notification, the acquisition unit <NUM> of the software update device <NUM> controls the communication unit <NUM> to transmit an update data request to the external device <NUM>. Note that, the first control unit <NUM> of the software update device <NUM> terminates the processing when the communication unit <NUM> receives the update dismissal notification.

The control unit <NUM> of the external device <NUM> controls the communication unit <NUM> to transmit the update data to the software update device <NUM>.

The communication unit <NUM> of the software update device <NUM> receives the update data (the downloading described above), and the first control unit <NUM> controls the in-vehicle device (not shown) to be updated based on the update data to store an update version of the program or perform initialization (the installation and the activation described above). Note that, when the update data includes the update program itself in the installation processing, the first control unit <NUM> transmits the update program to the in-vehicle device. When the update data includes compressed data, difference data, or divided data of the update program, the first control unit <NUM> may generate the update program by decompressing or assembling the update data and transmit the update program to the in-vehicle device. Alternatively, the first control unit <NUM> may transmit the update data to the in-vehicle device, and the in-vehicle device may generate the update program by decompressing or assembling the update data. Note that, the external device <NUM> and the software update device <NUM> may explicitly issue a command to the in-vehicle device to execute the installation and the activation and the in-vehicle device may execute the installation and the activation based on the command, or the in-vehicle device that has received the update data (or the update program) may autonomously execute the installation and the activation without any explicit command.

The explanation for each step is as described above. In the example above, the user can command whether to permit the update program using the mobile terminal device <NUM> set as the electronic key. Similarly, using the mobile terminal device <NUM>, the user can command whether inquiry of the presence or absence of the update program in step S201 described above is permitted, whether the update data request for downloading in step S207 is permitted, and whether the installation and the activation in step S209 are permitted.

As described above, the interface processing includes presentation of a progress status at one or more stages in the update processing, and reception of a command indicating whether further progress is permitted. Further, the mobile terminal device <NUM> may receive a command to update only the program of a specific in-vehicle device among the in-vehicle devices, for example, and the software update device <NUM> may execute update in accordance with the command. As described above, the information presented to the user by the mobile terminal device <NUM> and the command received by the mobile terminal device <NUM> from the user and executed by the software update device <NUM> are not limited.

In the example above, the second control unit <NUM> grants the mobile terminal device <NUM> an authority as a user interface for the update processing based on that the vehicle authenticates the mobile terminal device <NUM> as the electronic key and a predetermined operation to the vehicle is actually performed using the mobile terminal device <NUM> as the electronic key, that is, based on the authentication result and a history of usage as the electronic key.

With the processing above, reliability of the mobile terminal device <NUM> as the user interface from the standpoint of the vehicle can be more preferably guaranteed. The content of the predetermined operation above is not limited. However, the reliability can be more enhanced when the operation is an operation from which it can be estimated with high accuracy that the user is a driver of the vehicle, such as an opening operation or a closing operation of a driver door of the vehicle.

Further, the vehicle does not need to include the display unit when the mobile terminal device <NUM> can display and present information to the user and can receive the input from the user. Therefore, the update processing can be executed while the input from the user is received even when the vehicle is not provided with the display unit such as a car navigation system and a device including the input unit.

The acquisition unit <NUM> of the second control unit <NUM> may acquire the user authority information indicating whether the user associated with the mobile terminal device <NUM> is granted the update management authority, and in step S103, the authority management unit <NUM> may sets the mobile terminal device <NUM> as the mobile terminal device that is permitted for execution of the interface processing when the user is granted the update management authority including an authority to update the program of the in-vehicle device, in addition that the vehicle authenticates the mobile terminal device <NUM> as the electronic key and the predetermined operation to the vehicle is performed.

With the processing above, when the vehicle has a plurality of the users, only the user who is granted the update management authority can permit the program update. For example, when the users include an owner and a customer such as in the case of a car sharing service, a function as the user interface related to the program update can be assigned to the mobile terminal device of the owner only, and cannot be assigned to the mobile terminal device of a general customer. The user authority information is registered in advance in the mobile terminal device <NUM> or the external device <NUM> by a person having appropriate authority, and the acquisition unit <NUM> acquires the user authority information from the registered information. The external device <NUM> may create information such as a program or data for executing the interface processing in accordance with the user authority information, store the created information in association with the user authority information, and provide the associated information to the mobile terminal device <NUM>. The information for executing the interface processing is data indicating, for example, whether the inquiry for the presence or absence of the update program in step S201 above is permitted, whether the update data request in step S207 for downloading is permitted, whether the installation is permitted and the activation is permitted in step S209, a program to be executed by the mobile terminal device <NUM> so as to receive a command from the user, or a text or graphical user interface (GUI) to be displayed on the mobile terminal device <NUM> and presented to the user. The control unit <NUM> of the external device <NUM> controls the communication unit <NUM> to provide the above data to the mobile terminal device <NUM> of the user who is granted the update authority directly or via the software update device <NUM> in accordance with a request from the mobile terminal device <NUM>, a request from the authority management unit <NUM> of the software update device <NUM>, or autonomously without any request above. The processing above can be executed at any timing between step S103 and step S203 described above. Alternatively, the information for executing the interface processing may be stored in advance in the mobile terminal device <NUM>.

Further, the acquisition unit <NUM> of the second control unit <NUM> may acquire presentation information indicating that the mobile terminal device <NUM> has presented the predetermined information, and in step S103, the authority management unit <NUM> may set the mobile terminal device <NUM> as the mobile terminal device that is permitted for execution of the interface processing when the acquisition unit <NUM> acquires the presentation information in addition that the vehicle authenticates the mobile terminal device <NUM> as the electronic key and the predetermined operation to the vehicle is performed. The predetermined information is, for example, a manual for explaining a procedure for the program update. In this case, the procedure for the interface processing can be notified to the user in advance as a preliminary step before proceeding to the interface processing related to the actual program update such as downloading and installation. The information above can be transmitted by the software update device <NUM> or the external device <NUM> to the mobile terminal device <NUM>. When the mobile terminal device <NUM> presents the manual to the user, or further receives, from the user, an input indicating that the user has confirmed the manual, the mobile terminal device <NUM> transmits the presentation information to the software update device <NUM>.

With the processing above, execution of the interface processing is permitted after the manual, etc. is presented to the user. This makes it possible to suppress an erroneous operation of the user when user issues a command related to the update. Further, presentation of the information and confirmation of the information as described above may be performed as a part of the interface processing as in step S204. The external device <NUM> stores the information above such as a program and data for executing the interface processing. The external device <NUM> may transmit the information to the mobile terminal device <NUM> directly or via the software update device <NUM> in accordance with a request from the mobile terminal device <NUM> or from the vehicle. Alternatively, the vehicle may store the information and transmit the information to the mobile terminal device <NUM>.

After step S209 described above, the first control unit <NUM> may notify the mobile terminal device <NUM> that the update has been executed, and the mobile terminal device <NUM> may notify the user that the update has been executed based on the notification. In this case, the mobile terminal device <NUM> transmits, to the software update device <NUM>, an execution notification information indicating that the user has been notified that the program update has been executed. After step S209, the authority management unit <NUM> restricts a part or all of the functions of the mobile terminal device <NUM> as the electronic key by, for example, controlling the authentication device, until the acquisition unit <NUM> acquires the execution notification information.

With the processing above, it is possible to avoid confusing the user due to operating the vehicle inadvertently without knowing that the operation specifications have been changed due to the program update.

Further, after step S209, the authority management unit <NUM> may appropriately control the in-vehicle device such that a predetermined function of the vehicle can be operated only when a command is input to the mobile terminal device <NUM>. The predetermined function is, for example, a function that is likely to be executed when the vehicle is used. For example, when the mobile terminal device <NUM> has a function of receiving a command input for engine start and requesting and causing the vehicle to start the engine, the authority management unit <NUM> permits only the engine start using the mobile terminal device <NUM>, and invalidates the engine start triggered by pressing a start switch provided in the vehicle, etc..

With the processing above, when the user uses the vehicle after the update is executed, the user is reliably made to view and operate the mobile terminal device <NUM>. This can suppress operation of the vehicle by the user without checking a notification indicating that the update has been executed. Note that, the authority management unit <NUM> permits execution of the predetermined function based on a command input to the other means after the predetermined function is performed based on the command input to the mobile terminal device <NUM> after the update is executed.

Note that downloading of the update data as in step S208 described above can be executed while the vehicle is traveling. That is, in step S205, after the user permits the update, the user may drive the vehicle during execution of steps S206, S207, and S208. During the overwriting installation and the activation above in step S209, the traveling of the vehicle may be restricted because the functions of the in-vehicle device that execute the processing are restricted. If the interface processing involves a process in which the user can command whether the installation and the activation in step S209 is permitted as described above, the user can drive the vehicle to a destination without interruption by dismissing execution of the installation and the activation while the user desires to drive and permitting the installation and the activation after the user gets off the vehicle.

Further, the authority management unit <NUM> may permit the mobile terminal device <NUM> to acquire data for updating the program using a communication method different from the communication method used by the vehicle and transmit the data to the vehicle. The communication method when the vehicle communicates with the external device <NUM> is, for example, wireless communication via a public wireless base station. On the other hand, the mobile terminal device <NUM> can acquire data from, for example, the external device <NUM> via an optical fiber and a wireless local area network (LAN) in the house. Even when wireless communication between the external device <NUM> and the software update device <NUM> is difficult due to a radio wave condition around the vehicle and the software update device <NUM> cannot receive data from the public radio base station, the mobile terminal device <NUM> in the house can communicate with the external device <NUM> using a communication method without intervening the public radio base station, which is different from the communication method of the vehicle. Therefore, the update can be executed at an early stage even when the radio wave condition around the vehicle is poor in such a manner that the mobile terminal device <NUM> receives the data, temporarily stores the data, and then transmits the data to the software update device <NUM>. As described above, the mobile terminal device <NUM> may appropriately relay the communication between the external device <NUM> and the software update device <NUM>.

Further, the second control unit <NUM> is provided in the software update device <NUM> provided in the vehicle. However, at least a part of the functions of the second control unit <NUM> may be provided in the external device <NUM>. For example, the external device <NUM> may execute the processing of setting the mobile terminal device <NUM> as the mobile terminal device that is permitted for execution of the interface processing, etc. in step S103 by appropriately communicating with the software update device <NUM> and acquiring the cooperation information.

As described above, in the present embodiment, the software update device grants the mobile terminal device the authority as the user interface for the update processing based on that the vehicle authenticates the mobile terminal device as the electronic key and the predetermined operation to the vehicle is actually performed using the mobile terminal device as the electronic key. This makes it possible to guarantee the reliability of the mobile terminal device as the user interface.

The disclosed technology can be interpreted as, in addition to the software update device, a method executed by a computer included in each of a network system including the software update device, the external device, the mobile terminal device and various devices, a program and a computer-readable non-transitory storage medium that stores the program, a vehicle provided with the software update device, and a system including the vehicle, the external device, and the mobile terminal device, etc..

Claim 1:
A software update device (<NUM>) configured to be controlled in response to a request from a mobile terminal device (<NUM>), the software update device (<NUM>) comprising one or more processors (<NUM>) configured to:
acquire (S102) cooperation information indicating that connection of the mobile terminal device (<NUM>) to a vehicle is made;
manage whether the mobile terminal device (<NUM>) is permitted to execute interface processing related to software update, which is determined in accordance with at least the cooperation information;
acquire execution notification information indicating that the mobile terminal device (<NUM>) has notified a user that the software update has been executed; and
restrict at least a part of control based on a function as an electronic key in response to a request from the mobile terminal device (<NUM>) until the one or more processors (<NUM>) acquire the execution notification information after the software update has been executed.