Abstract: The present invention makes it possible to identify software that is safe and determines what software can be rolled back while maintaining a high level of safety and security. A software updating device E1000 includes: software unit storage E1520 that stores a plurality of software units UX000 that include label information UX400; and an update control unit E1400 that controls software updates for a vehicular control device ECU_EX000. The label information UX400 includes at least safety-related information for the software units UX000. Upon receiving a rollback command, the update control unit E1400 selects software from the plurality of software units UX000 that has safety-related label information UX400 that is identical to safety-related label information UX400 of software installed at the vehicular control device as software to roll back.

Abstract: Provided is a transfer device capable of suppressing shortage of memory resources even when the transfer device receives a diagnosis request from an external diagnostic equipment with respect to a plurality of electronic devices. A transfer device 20 receives a diagnosis request that is a message from an external diagnostic equipment 10 to a plurality of ECUs 18 from the external diagnostic equipment 10, and transfers the diagnosis request to some ECUs 18 out of a plurality of ECUs 18. Then, the transfer device 20 receives a diagnosis response that is a message from the ECU18 to the external diagnostic equipment 10 from some ECUs 18, transfers the diagnosis response to the external diagnostic equipment 10 and, thereafter, transfers the diagnosis request to ECUs 18 different from the above-mentioned some ECUs 18.

Abstract: The present disclosure provides an information processing apparatus that enables updating of a key for program verification without invalidating a program verification function. An information processing apparatus 1 that calculates a verification value using a key for program verification and that verifies whether the verification value matches a verification expected value stored in advance. The information processing apparatus 1 includes: a key updating control unit 12 that updates the key; a storage unit 100 that stores in advance a verification expected value corresponding to a key updated by the key updating control unit 12; and a verification expected value changing unit 13 that when a verification value calculated based on the updated key is verified, changes the verification expected value in the storage unit, the verification expected value being referred to for verification, to a verification value corresponding to the updated key.

Abstract: The present disclosure provides an information processing device and a key management device capable of safely writing key information even in a manufacturing environment other than a manufacturing environment of its own company. An information processing device 1 that generates and manages a key includes a storage unit 100 that stores a public key received from a key management device 3, a key generation unit 13 that generates a use key, and a communication unit 11 capable of communicating with the outside. The key generation unit 13 generates a use key in an invalid state in which the communication unit 11 blocks signal input from the outside. The communication unit 11 transmits the use key encrypted with the public key to the key management device 3.

Abstract: The disclosure provides a vehicle control system (VCS) capable of safely and forcibly controlling a vehicle. The VCS includes a mode setting unit configured to output a forced mode signal upon receiving a forced control instruction from outside the vehicle via a communication device, and a forced operation unit configured to output a forced operation signal of forcibly operating vehicle to an operation control unit. Further, the VCS includes a signal selection unit configured to allow all the operation signals to pass therethrough before receiving the forced mode signal, and block at least a part of the operation signals and allow the forced operation signal instead of the blocked operation signal to pass therethrough after receiving the forced mode signal. The VCS controls an operation of the vehicle by controlling the operation control unit based on the operation signal or the forced operation signal passing through the signal selection unit.

Abstract: An in-vehicle processing device mounted in a vehicle includes a calculation unit that calculates output data based on input data, a storage unit that stores data, a data management unit that manages data stored in the storage unit, and a log collection unit that collects a log in the in-vehicle processing device and outputs the log to outside. The data management unit inputs data stored in the storage unit to the calculation unit as the input data and stores the output data output from the calculation unit in the storage unit, and the log collection unit refers to and acquires data stored in the storage unit and outputs the log to the outside.

Abstract: An electronic control device includes a tamper storage unit that stores a secure boot key and a control key, and has tamper resistance, a processor that is able to execute a program, a verification unit that verifies a program by using the secure boot key, performs secure boot causing the processor to execute the program based on a result of the verification, and has tamper resistance, a calculation unit that performs calculation related to encryption using the control key, and has tamper resistance, and a general storage unit that stores a first program that implements a delegated verification unit to which authority of the secure boot is delegated from the verification unit and a second program that implements a control unit that uses the calculation unit, and does not have tamper resistance.

Abstract: An object is to shorten a time required for reprogramming of a control device including a single-bank microcomputer. An ECU 901 is a control device including a first microcomputer 1 and a second microcomputer 2 that execute a program stored in a rewriting area 13 in which a memory bank is configured as a single bank. The second microcomputer 2 includes a preprocessing unit 214 that performs preprocessing on a rewriting program 5 in reprogramming processing of rewriting the program stored in the rewriting area 13 into the rewriting program 5, and a transmission unit 213 that transmits the preprocessed rewriting program 5 to the first microcomputer 1. The first microcomputer 1 includes a reception unit 121 that receives the rewriting program 5 transmitted from the second microcomputer 2, and a writing unit 122 that writes the received rewriting program 5 in the rewriting area 13.

Abstract: An object of the present invention is to minimize a likelihood of the vehicle becoming in an inoperable state even in an event of a program update failure. An in-vehicle device 6 includes: a program storage unit 64 that stores a program; an activation processing unit 65 that activates the program; and an update processing unit 63 that receives an update program 21 and an update reason 22 of the program and updates the program with the update program 21. In a case where the update of the program has failed, the activation processing unit 65 activates the program in an activation mode corresponding to the update reason 22.

Abstract: An electronic control device 140 is mounted on an on-vehicle control system 10 that performs travel control of an automobile, and is communicatively connected to a plurality of control devices including a first control device (electronic control device 120) and a second control device (electronic control device 130). The electronic control device 140 includes an attack determination unit 145 that determines presence or absence of a security attack in each control device, and a redundant system execution determination unit 146 that determines whether to cause the second control device to execute a redundant function similar to or a part of the function performed by the first control device based on the result of determination by the attack determination unit 145.

Abstract: Function definition information is prepared in a system. The function definition information is information representing a correspondence relationship among a software-based function, a vehicle ID of a vehicle, a hardware configuration for implementing a function, and a software configuration for implementing a function. The system performs a preliminary determination including a determination of a relationship between one or a plurality of user-desired functions constituting a user-desired function group of a user and a hardware configuration of a target vehicle based on the function definition information. For each of the one or more functions specified in the preliminary determination, in order to implement the function in the target vehicle, the system develops a software configuration corresponding to the function in a hardware configuration corresponding to the function in the target vehicle.

Abstract: Provided is an analysis device that reduces false detection of an attack event to appropriately output an anomaly notification. The analysis device configured to be communicable with a plurality of monitoring-target devices collects monitoring results of each of the monitoring-target devices, determines whether an anomaly has occurred in each of the monitoring-target devices, based on the monitoring results, and determines whether to output an anomaly notification indicating the anomaly, based on a result of the determination and code verification results of each of the monitoring-target devices.

Abstract: An object of the present invention is to easily realize safe startup of a control apparatus including a plurality of arithmetic processing devices. A control apparatus 5 includes a first microcomputer 1 including a processor that executes a first program, a second microcomputer 2 including a processor that executes a second program, and a storage device 3 that stores the second program. The first microcomputer 1 includes a verification unit 1221 that verifies whether each of the first program and the second program has been falsified, a first acquisition unit 1126 that acquires the second program from the storage device 3 when the verification unit 1221 verifies that the first program is not falsified, and a startup permission notification unit 1124 that notifies the second microcomputer 2 of startup permission of the second program when the verification unit 1221 verifies that the second program is not falsified.

Abstract: An object of the present invention is to provide a technique that enables a driver to approve transmission of vehicle data to a data center. The information system includes a first device (101-a) mounted in a vehicle, a second device (102-a) operated by a driver, and a third device (103). The first device classifies the vehicle data into the first data and the second data according to preset classification conditions. The first data is data for which an approval operation by the driver is requested. The second data is data for which the approval operation by the driver is not requested. The first device transmits the first data to the second device and transmits the second data to the third device. The second device receives the first data from the first device, and transmits the first data to the third device in response to the approval operation by the driver.

Abstract: An object of the present invention is to provide a program update technique capable of easily managing a software state of an electronic control unit (ECU), and updating an ECU application and a data collecting program in association with each other with management information about the software states matching between a vehicle and a center. A vehicle control device of the present invention collectively transmits a first update state of a first program executed by the vehicle control device and a second update state of a second program executed by a second vehicle control device to an update server, receives an update version of the program corresponding to the first update state and an update version of the program corresponding to the second update state from the update server, and executes update processing (FIG. 1).

Abstract: The present disclosure provides a vehicle control system capable of safely and forcibly controlling a vehicle. A vehicle control system VCS includes a mode setting unit 56 configured to output a forced mode signal upon receiving a forced control instruction from the outside of a vehicle V via a communication device 30, and a forced operation unit 58 configured to output a forced operation signal of forcibly operating the vehicle V to an operation control unit 20. Further, the vehicle control system VCS includes a signal selection unit 59 configured to allow all the operation signals to pass therethrough before receiving the forced mode signal, and block at least a part of the operation signals and allow the forced operation signal instead of the blocked operation signal to pass therethrough after receiving the forced mode signal.

Abstract: An electronic control device includes a tamper storage unit that stores a secure boot key and a control key, and has tamper resistance, a processor that is able to execute a program, a verification unit that verifies a program by using the secure boot key, performs secure boot causing the processor to execute the program based on a result of the verification, and has tamper resistance, a calculation unit that performs calculation related to encryption using the control key, and has tamper resistance, and a general storage unit that stores a first program that implements a delegated verification unit to which authority of the secure boot is delegated from the verification unit and a second program that implements a control unit that uses the calculation unit, and does not have tamper resistance.

Abstract: Provided are a control device and a program verification method capable of suppressing an operation load in a case where different keys are used for respective devices. The control device 1 stores a program to be verified, a plurality of verification expected values related to verification of the program to be verified, and registered verification expected value information 183 that identifies one of the verification expected values. The control device verifies whether the program to be verified is correct using the registered verification expected value information 183.

Abstract: An information processing device that executes a program includes: a storage unit that includes a plurality of regions for storing a rewritable program; a calculation unit that executes a program stored in the storage unit; a start region specification unit that specifies, from the plurality of regions, a start region in which the calculation unit is executing a program; a rule update unit that specifies a rewrite target region in which a program can be rewritten based on information on the specified start region; and a reception selection unit that selectively receives a rewrite program stored in the rewrite target region.

Abstract: When updating a key to guarantee security, updating the key during decryption of update data causes an ECU to stop functioning due to a decryption failure. Therefore, an in-vehicle gateway or a key management device of the present invention includes: an update data acquisition unit that receives, from outside a vehicle, update data encrypted with a predetermined key; a key acquisition unit that receives a key from outside the vehicle; a key storage unit in which the key received by the key acquisition unit is stored; and a decryption unit that decrypts the update data acquired by the update data acquisition unit based on the key stored in the storage unit, in which the update data acquisition unit transmits a key acquisition request signal after completion of decryption of the update data by the decryption unit.