In-vehicle communication system, vehicle control device, and communication management device

Patent metadata

Field	Value
Publication number	US-10214182-B2
Application number	US-201815912462-A
Country	US
Kind code	B2
Filing date	Mar 5, 2018
Priority date	Mar 31, 2017
Publication date	Feb 26, 2019
Grant date	Feb 26, 2019

Abstract

An in-vehicle communication system includes: a plurality of local ECUs (vehicle control devices) connected to networks of buses, and configured to control an in-vehicle device; an OBDII port which is a communication port to an outside; and an illicit act detection sensor configured to detect an illicit act on a vehicle. Each local ECU includes a reprogramming receiver and a reprogramming controller. The reprogramming receiver receives a reprogramming request signal and reprogramming data from a reprogramming device connected to the OBDII port. Reprogramming for rewriting a software program of a target local ECU is executed according to the reprogramming request signal and the reprogramming data. When the illicit act detection sensor detects an illicit act, the reprogramming controller prohibits execution of reprogramming.

First claim

The invention claimed is:

1. An in-vehicle communication system comprising:
a plurality of vehicle control devices connected to a network of a vehicle, configured to communicate with each other, and configured to control an in-vehicle device to be controlled;
a communication port which is a communication port to an outside; and
a reprogramming receiver configured to receive a reprogramming request signal and data from an external device connected to the communication port,
wherein reprogramming for rewriting a software program of a target vehicle control device from among the plurality of vehicle control devices is executed according to the reprogramming request signal and the data received by the reprogramming receiver,
the in-vehicle communication system further comprising:
an illicit act detector configured to detect an illicit act on the vehicle; and
a reprogramming controller configured to prohibit execution of the reprogramming when the illicit act detector detects the illicit act.

2. The in-vehicle communication system according to claim 1 , further comprising
a reprogramming authenticator configured to perform authentication according to authentication information included in the reprogramming request signal received by the reprogramming receiver,
wherein the reprogramming controller prohibits execution of the reprogramming when the reprogramming authenticator does not succeed in authentication, and
wherein the reprogramming controller allows execution of the reprogramming when the illicit act detector does not detect the illicit act and the reprogramming authenticator succeeds in authentication.

3. The in-vehicle communication system according to claim 2 ,
wherein the communication port is connected to one of the network and each of the plurality of vehicle control devices,
wherein the reprogramming receiver, the reprogramming controller, and the reprogramming authenticator are provided in each of the plurality of vehicle control devices,
wherein the illicit act detector is connected to a specific vehicle control device from among the plurality of vehicle control devices,
wherein, when the illicit act detector detects the illicit act, the specific vehicle control device sets an illicitness detection flag in a storage inside and transmits an illicitness detection notification indicating that the illicit act is detected to another of the plurality of vehicle control devices via the network,
wherein, when the other of the plurality of vehicle control devices receives the illicitness detection notification, the other vehicle control device sets an illicitness detection flag in the storage inside,
wherein, when the reprogramming receiver receives the reprogramming request signal, in a state where one of a condition that the illicitness detection flag is set and a condition that the reprogramming authenticator does not succeed in authentication is satisfied, each of the plurality of vehicle control devices causes the reprogramming controller to prohibit execution of the reprogramming, and in a state where the illicitness detection flag is not set and the reprogramming authenticator succeeds in authentication, each of the plurality of vehicle control devices allows the reprogramming controller to execute the reprogramming, and executes the reprogramming according to the reprogramming request signal and the data received by the reprogramming receiver.

4. The in-vehicle communication system according to claim 2 , further comprising
a communication management device connected to the network, configured to communicate with each of the plurality of vehicle control devices, configured to transfer a signal received from one of the plurality of vehicle control devices to another of the plurality of vehicle control devices, and configured to manage communication between the plurality of vehicle control devices,
wherein the communication port is connected to the communication management device,
wherein the reprogramming receiver is provided in the communication management device and each of the plurality of vehicle control devices,
wherein the reprogramming controller and the reprogramming authenticator are provided in each of the plurality of vehicle control devices,
wherein the illicit act detector is connected to a specific vehicle control device from among the plurality of vehicle control devices,
wherein when the illicit act detector detects the illicit act, the specific vehicle control device transmits an illicitness detection notification indicating that the illicit act is detected to the communication management device via the network,
wherein when the communication management device receives the illicitness detection notification, the communication management device sets an illicitness detection flag in a storage inside,
wherein when the reprogramming receiver receives the reprogramming request signal, in a state where the illicitness detection flag is set, the communication management device destroys the reprogramming request signal and the data received by the reprogramming receiver, and in a state where the illicitness detection flag is not set, the communication management device transfers the reprogramming request signal and the data received by the reprogramming receiver to each of the plurality of vehicle control devices via the network, and
wherein when the reprogramming receiver receives the reprogramming request signal from the communication management device, in a state where the reprogramming authenticator does not succeed in authentication, each of the plurality of vehicle control devices causes the reprogramming controller to prohibit execution of the reprogramming, and in a state where the reprogramming authenticator succeeds in authentication, each of the plurality of vehicle control devices allows the reprogramming controller to execute the reprogramming and executes the reprogramming according to the reprogramming request signal and the data received by the reprogramming receiver.

5. The in-vehicle communication system according to claim 1 ,
wherein a power supply of the vehicle is switched from off to on according to one of an operation of a power switch provided in the vehicle and a signal of an electronic key registered in the vehicle,
the in-vehicle communication system further comprising
a power supply detector configured to detect an on state and an off state of the power supply of the vehicle,
wherein when the power supply detector detects the off state of the power supply of the vehicle, the reprogramming receiver is disabled, and
wherein when the power supply detector detects the on state of the power supply of the vehicle, the reprogramming receiver is enabled.

6. The in-vehicle communication system according to claim 1 , wherein the illicit act detector detects an illicit act on the vehicle with a possibility of theft.

7. The in-vehicle communication system according to claim 1 , wherein the illicitness detection flag which is set is automatically cleared upon satisfaction of a predetermined cancellation condition.

8. A vehicle control device a plurality of which is connected to a network of a vehicle and communicates with each other, the vehicle control device controlling an in-vehicle device to be controlled,
the vehicle control device comprising
a reprogramming receiver configured to receive a reprogramming request signal and data from an external device connected to a communication port which is a communication port to an outside,
wherein the vehicle control device executes reprogramming for rewriting a software program of the vehicle control device according to the reprogramming request signal and the data received by the reprogramming receiver,
the vehicle control device further compri

Assignees

• Murase Tomohiro
• Ishihara Naoyuki
• Tomita Yosuke
• Omron Automotive Electronics

Inventors

• Murase Tomohiro
• Ishihara Naoyuki
• Tomita Yosuke

Classifications

• B60R25/302

  using recording means, e.g. black box · CPC title

• G06F21/51

  at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability · CPC title

• H04W4/48 Primary

  for in-vehicle communication · CPC title

• B60R25/307 Primary

  using data concerning maintenance or configuration · CPC title

• B60R25/00

  Fittings or systems for preventing or indicating unauthorised use or theft of vehicles (locks for vehicles E05B77/00-E05B85/00) · CPC title