Abstract: An object is to shorten a time required for reprogramming of a control device including a single-bank microcomputer. An ECU 901 is a control device including a first microcomputer 1 and a second microcomputer 2 that execute a program stored in a rewriting area 13 in which a memory bank is configured as a single bank. The second microcomputer 2 includes a preprocessing unit 214 that performs preprocessing on a rewriting program 5 in reprogramming processing of rewriting the program stored in the rewriting area 13 into the rewriting program 5, and a transmission unit 213 that transmits the preprocessed rewriting program 5 to the first microcomputer 1. The first microcomputer 1 includes a reception unit 121 that receives the rewriting program 5 transmitted from the second microcomputer 2, and a writing unit 122 that writes the received rewriting program 5 in the rewriting area 13.

Abstract: An object of the present invention is to minimize a likelihood of the vehicle becoming in an inoperable state even in an event of a program update failure. An in-vehicle device 6 includes: a program storage unit 64 that stores a program; an activation processing unit 65 that activates the program; and an update processing unit 63 that receives an update program 21 and an update reason 22 of the program and updates the program with the update program 21. In a case where the update of the program has failed, the activation processing unit 65 activates the program in an activation mode corresponding to the update reason 22.

Abstract: An electronic control device 140 is mounted on an on-vehicle control system 10 that performs travel control of an automobile, and is communicatively connected to a plurality of control devices including a first control device (electronic control device 120) and a second control device (electronic control device 130). The electronic control device 140 includes an attack determination unit 145 that determines presence or absence of a security attack in each control device, and a redundant system execution determination unit 146 that determines whether to cause the second control device to execute a redundant function similar to or a part of the function performed by the first control device based on the result of determination by the attack determination unit 145.

Abstract: Function definition information is prepared in a system. The function definition information is information representing a correspondence relationship among a software-based function, a vehicle ID of a vehicle, a hardware configuration for implementing a function, and a software configuration for implementing a function. The system performs a preliminary determination including a determination of a relationship between one or a plurality of user-desired functions constituting a user-desired function group of a user and a hardware configuration of a target vehicle based on the function definition information. For each of the one or more functions specified in the preliminary determination, in order to implement the function in the target vehicle, the system develops a software configuration corresponding to the function in a hardware configuration corresponding to the function in the target vehicle.

Abstract: Provided is an analysis device that reduces false detection of an attack event to appropriately output an anomaly notification. The analysis device configured to be communicable with a plurality of monitoring-target devices collects monitoring results of each of the monitoring-target devices, determines whether an anomaly has occurred in each of the monitoring-target devices, based on the monitoring results, and determines whether to output an anomaly notification indicating the anomaly, based on a result of the determination and code verification results of each of the monitoring-target devices.

Abstract: An object of the present invention is to easily realize safe startup of a control apparatus including a plurality of arithmetic processing devices. A control apparatus 5 includes a first microcomputer 1 including a processor that executes a first program, a second microcomputer 2 including a processor that executes a second program, and a storage device 3 that stores the second program. The first microcomputer 1 includes a verification unit 1221 that verifies whether each of the first program and the second program has been falsified, a first acquisition unit 1126 that acquires the second program from the storage device 3 when the verification unit 1221 verifies that the first program is not falsified, and a startup permission notification unit 1124 that notifies the second microcomputer 2 of startup permission of the second program when the verification unit 1221 verifies that the second program is not falsified.

Abstract: An object of the present invention is to provide a program update technique capable of easily managing a software state of an electronic control unit (ECU), and updating an ECU application and a data collecting program in association with each other with management information about the software states matching between a vehicle and a center. A vehicle control device of the present invention collectively transmits a first update state of a first program executed by the vehicle control device and a second update state of a second program executed by a second vehicle control device to an update server, receives an update version of the program corresponding to the first update state and an update version of the program corresponding to the second update state from the update server, and executes update processing (FIG. 1).

Abstract: An object of the present invention is to provide a technique that enables a driver to approve transmission of vehicle data to a data center. The information system includes a first device (101-a) mounted in a vehicle, a second device (102-a) operated by a driver, and a third device (103). The first device classifies the vehicle data into the first data and the second data according to preset classification conditions. The first data is data for which an approval operation by the driver is requested. The second data is data for which the approval operation by the driver is not requested. The first device transmits the first data to the second device and transmits the second data to the third device. The second device receives the first data from the first device, and transmits the first data to the third device in response to the approval operation by the driver.

Abstract: The present disclosure provides a vehicle control system capable of safely and forcibly controlling a vehicle. A vehicle control system VCS includes a mode setting unit 56 configured to output a forced mode signal upon receiving a forced control instruction from the outside of a vehicle V via a communication device 30, and a forced operation unit 58 configured to output a forced operation signal of forcibly operating the vehicle V to an operation control unit 20. Further, the vehicle control system VCS includes a signal selection unit 59 configured to allow all the operation signals to pass therethrough before receiving the forced mode signal, and block at least a part of the operation signals and allow the forced operation signal instead of the blocked operation signal to pass therethrough after receiving the forced mode signal.

Abstract: An electronic control device includes a tamper storage unit that stores a secure boot key and a control key, and has tamper resistance, a processor that is able to execute a program, a verification unit that verifies a program by using the secure boot key, performs secure boot causing the processor to execute the program based on a result of the verification, and has tamper resistance, a calculation unit that performs calculation related to encryption using the control key, and has tamper resistance, and a general storage unit that stores a first program that implements a delegated verification unit to which authority of the secure boot is delegated from the verification unit and a second program that implements a control unit that uses the calculation unit, and does not have tamper resistance.

Abstract: Provided are a control device and a program verification method capable of suppressing an operation load in a case where different keys are used for respective devices. The control device 1 stores a program to be verified, a plurality of verification expected values related to verification of the program to be verified, and registered verification expected value information 183 that identifies one of the verification expected values. The control device verifies whether the program to be verified is correct using the registered verification expected value information 183.

Abstract: An information processing device that executes a program includes: a storage unit that includes a plurality of regions for storing a rewritable program; a calculation unit that executes a program stored in the storage unit; a start region specification unit that specifies, from the plurality of regions, a start region in which the calculation unit is executing a program; a rule update unit that specifies a rewrite target region in which a program can be rewritten based on information on the specified start region; and a reception selection unit that selectively receives a rewrite program stored in the rewrite target region.

Abstract: When updating a key to guarantee security, updating the key during decryption of update data causes an ECU to stop functioning due to a decryption failure. Therefore, an in-vehicle gateway or a key management device of the present invention includes: an update data acquisition unit that receives, from outside a vehicle, update data encrypted with a predetermined key; a key acquisition unit that receives a key from outside the vehicle; a key storage unit in which the key received by the key acquisition unit is stored; and a decryption unit that decrypts the update data acquired by the update data acquisition unit based on the key stored in the storage unit, in which the update data acquisition unit transmits a key acquisition request signal after completion of decryption of the update data by the decryption unit.

Abstract: The autonomous driving ECU includes a first communication unit that transmits and receives autonomous driving data to and from the plurality of data ECUs, and a vehicle control unit that controls a vehicle on the basis of the autonomous driving data transmitted from the plurality of data ECUs. Each data ECU includes a data construction unit that performs a construction of the autonomous driving data transmitted to the autonomous driving ECU, and a second communication unit that transmits and receives the autonomous driving data to and from the autonomous driving ECU. If a predetermined event occurs, among the data ECUs, the data construction unit of the data ECU in which the predetermined event occurs constructs the autonomous driving data so that a total amount of the autonomous driving data transmitted from the data ECU in which the predetermined event occurs is not greater than a predetermined amount of data.

Abstract: The gateway device includes a plurality of communication ports that are connected to the respective low-level networks and receive low-level data that is transmitted and received to and from the low-level networks; a storage unit that stores each of the plurality of communication ports and a source identifier in association with each other; and a control unit that generates high-level data and transmits the high-level data to the high-level network, in which the payload of the high-level data that is generated by the control unit includes at least a part of the low-level data that is received by the communication ports, and in which the header of the high-level data that is generated by the control unit includes the source identifier which is associated with the communication ports.

Abstract: When updating a key to guarantee security, updating the key during decryption of update data causes an ECU to stop functioning due to a decryption failure. Therefore, an in-vehicle gateway or a key management device of the present invention includes: an update data acquisition unit that receives, from outside a vehicle, update data encrypted with a predetermined key; a key acquisition unit that receives a key from outside the vehicle; a key storage unit in which the key received by the key acquisition unit is stored; and a decryption unit that decrypts the update data acquired by the update data acquisition unit based on the key stored in the storage unit, in which the update data acquisition unit transmits a key acquisition request signal after completion of decryption of the update data by the decryption unit.

Abstract: The autonomous driving ECU includes a first communication unit that transmits and receives autonomous driving data to and from the plurality of data ECUs, and a vehicle control unit that controls a vehicle on the basis of the autonomous driving data transmitted from the plurality of data ECUs. Each data ECU includes a data construction unit that performs a construction of the autonomous driving data transmitted to the autonomous driving ECU, and a second communication unit that transmits and receives the autonomous driving data to and from the autonomous driving ECU. If a predetermined event occurs, among the data ECUs, the data construction unit of the data ECU in which the predetermined event occurs constructs the autonomous driving data so that a total amount of the autonomous driving data transmitted from the data ECU in which the predetermined event occurs is not greater than a predetermined amount of data.

Abstract: The gateway device includes a plurality of communication ports that are connected to the respective low-level networks and receive low-level data that is transmitted and received to and from the low-level networks; a storage unit that stores each of the plurality of communication ports and a source identifier in association with each other; and a control unit that generates high-level data and transmits the high-level data to the high-level network, in which the payload of the high-level data that is generated by the control unit includes at least a part of the low-level data that is received by the communication ports, and in which the header of the high-level data that is generated by the control unit includes the source identifier which is associated with the communication ports.

Abstract: A data collection server includes a load monitoring unit configured to monitor a load on the computer system, and a management unit configured to, based on a result of the monitoring, determine a content of a transfer process of data executed at one of servers and transmit the determined content of the transfer process of data to the one of the servers. The management unit determines a type of the transfer process applied to the one of the servers, generates a process subject data list indicating a list of data to which the transfer process is applied out of the data transferred to the data collection server based on the determined type of the transfer process, and determines the content of the transfer process applied to the one of the servers based on the determined type of the transfer process and the generated process subject data list.

Abstract: A data collection server includes a load monitoring unit configured to monitor a load on the computer system, and a management unit configured to, based on a result of the monitoring, determine a content of a transfer process of data executed at one of servers and transmit the determined content of the transfer process of data to the one of the servers. The management unit determines a type of the transfer process applied to the one of the servers, generates a process subject data list indicating a list of data to which the transfer process is applied out of the data transferred to the data collection server based on the determined type of the transfer process, and determines the content of the transfer process applied to the one of the servers based on the determined type of the transfer process and the generated process subject data list.