JP7543875B2 - Electronic control device, time information providing method, time information providing program, and electronic control system - Google Patents

Description

The present invention relates to an electronic control device, and primarily relates to an electronic control device for a vehicle, a method implemented by the electronic control device, a program executable by the electronic control device, and an electronic control system comprising the electronic control device.

Automobiles are equipped with various electronic control devices that are connected via an in-vehicle network. By sharing a common time axis, these electronic control devices can link the functions of the various electronic control devices to control the automobile. For this reason, there is a demand for time synchronization between the various electronic control devices installed in the automobile.

For example, Patent Document 1 discloses a time synchronization system that synchronizes the time between interconnected in-vehicle devices. In the time synchronization system of Patent Document 1, a grand master that serves as a reference within the network is determined, and the time of the slave devices is synchronized to the time of the determined grand master. Then, when each device in the network detects an abnormality in the grand master by monitoring the error in the grand master's clock, a new grand master is determined, thereby preventing deterioration of the accuracy of time synchronization within the network.

JP 2020-167616 A

The master device (grand master) that provides the reference time in the in-vehicle system can improve the accuracy of the time of the master device, and ultimately the entire in-vehicle system, by periodically obtaining time information from a master clock that has absolute time, such as a GPS (Global Positioning System) or GNSS (Global Navigation Satellite System) receiver.

Here, the present inventors have found the following problem.
In order to prevent unauthorized access to the master clock and to increase the security of the entire in-vehicle system, it is desirable to perform authentication when the master device accesses the master clock. However, if it becomes necessary to change the master device for some reason, the new master device must be newly authenticated in order to access the master clock, which may take time to change the master device. Furthermore, while the new master device is being authenticated, it cannot access the master clock and cannot provide time information to the slave devices, which may degrade the accuracy of time synchronization of the entire in-vehicle system.

The present invention aims to shorten the time required to change the master device while ensuring security by authenticating access from the master device to the master clock.

An electronic control device according to one aspect of the present disclosure is an electronic control device that provides reference time information to a slave unit (410), and includes an authentication request transmission unit (111) that requests an authentication unit (310) to authenticate access to a master clock (50) having a reference time, an authentication result reception unit (112) that receives an authentication result of access to the master clock from the authentication unit, a time information acquisition unit (122) that accesses the master clock and acquires the reference time when access to the master clock is permitted by the authentication unit, a time information transmission unit (124) that transmits the time information indicating the reference time to the slave unit, and an authenticated information transmission unit (113) that transmits authenticated information indicating that access to the master clock is permitted to a standby master device (20) connected to the electronic control device, and the standby master device is a device that can transmit the time information to the slave unit on behalf of the electronic control device.

An electronic control device according to one aspect of the present disclosure is an electronic control device that provides reference time information to a slave unit (410), and includes an authenticated information receiving unit (211) that receives authenticated information indicating that access to a master clock (50) having a reference time is permitted from a master unit (10) that transmits the time information to the slave unit, a stop detection unit (226) that detects that the master unit has stopped, a time information acquisition unit (222) that accesses the master clock using the authenticated information to acquire the reference time when the stop detection unit detects that the master unit has stopped, and a time information transmission unit (224) that transmits the time information indicating the reference time to the slave unit.

The numbers in parentheses attached to the constituent elements of the invention described in the claims and this section indicate the correspondence between the present invention and the embodiments described below, and are not intended to limit the present invention.

The electronic control device, time information providing method, time information providing program, and electronic control system disclosed herein make it possible to reduce the time required to change the master device while ensuring security by restricting access from the master device to the master clock.

FIG. 1 is a diagram illustrating an electronic control system according to an embodiment of the present invention. FIG. 1 is a diagram illustrating the configuration of an electronic control unit that is a master device according to an embodiment of the present invention. FIG. 1 is a diagram illustrating a configuration of an electronic control device that is a standby master device according to an embodiment of the present invention. FIG. 1 is a diagram for explaining the operation of the entire electronic control system according to the present embodiment. FIG. 2 is a diagram for explaining the operation of the electronic control unit that is the master device of the present embodiment. FIG. 2 is a diagram for explaining the operation of the electronic control device that is the standby master device of the present embodiment.

The following describes an embodiment of the present invention with reference to the drawings.

The present invention refers to the invention described in the claims or in the Means for Solving the Problems section, and is not limited to the following embodiments. Furthermore, at least the words in quotation marks refer to the words described in the claims or in the Means for Solving the Problems section, and are not limited to the following embodiments.

The configurations and methods described in the dependent claims of the claims are optional configurations and methods in the invention described in the independent claims of the claims. The configurations and methods of the embodiments corresponding to the configurations and methods described in the dependent claims, and the configurations and methods described only in the embodiments without being described in the claims, are optional configurations and methods in the present invention. The configurations and methods described in the embodiments when the description of the claims is broader than the description of the embodiments are also optional configurations and methods in the present invention in the sense that they are examples of the configurations and methods of the present invention. In either case, by being described in the independent claims of the claims, they become essential configurations and methods of the present invention.

The effects described in the embodiments are the effects when the configuration of the embodiment is an example of the present invention, and are not necessarily the effects of the present invention.

When there are multiple embodiments, the configurations disclosed in each embodiment are not limited to each embodiment, but can be combined across the embodiments. For example, a configuration disclosed in one embodiment may be combined with another embodiment. Also, the configurations disclosed in each of the multiple embodiments may be collected and combined.

The problem described in the problem that the invention is intended to solve is not a publicly known problem, but was discovered independently by the inventor, and this fact, together with the configuration and method of the present invention, affirms the inventive step of the invention.

1. Configuration of the in-vehicle system 1 The electronic control device and the electronic control system of the present embodiment will be described with reference to Fig. 1. The electronic control device and the electronic control system of the present embodiment are assumed to be in-vehicle devices and in-vehicle systems "mounted" on a vehicle, which is a "moving body", but are not limited thereto.

Here, the term "mobile body" refers to an object that can move and can move at any speed. It also includes cases where the moving body is stationary. For example, it includes, but is not limited to, automobiles, motorcycles, bicycles, pedestrians, ships, aircraft, and objects mounted on these vehicles.
In addition, "mounted" includes not only the case where the device is directly fixed to the moving body, but also the case where the device is not fixed to the moving body but moves with the moving body, such as the case where the device is carried by a person riding on the moving body, or the case where the device is mounted on cargo placed on the moving body.

The electronic control system 1 is a system that is composed of multiple "electronic control units" (hereinafter, ECUs: Electronic Control Units) (ECU10 to ECU40) and a master clock 50. The electronic control system 1 is composed of any number of ECUs. These ECUs and the master clock 50 are connected via, for example, an in-vehicle network such as a Controller Area Network (CAN) or a Local Interconnect Network (LIN), Ethernet (registered trademark), or a wireless communication network.

Here, the "electronic control device" may be configured as a so-called information processing device, for example, that is mainly composed of semiconductor devices and has a volatile storage unit such as a CPU (Central Processing Unit) and a RAM (Random Access Memory). In this case, the information processing device may further have a non-volatile storage unit such as a flash storage unit, a network interface unit connected to a communication network, etc. Furthermore, such an information processing device may be a packaged semiconductor device (element), or may be configured such that each semiconductor device is wired and connected on a wiring board.

The ECUs 10 to 40 constituting the electronic control system 1 are assumed to be ECUs based on a platform called an Adaptive Platform (AP) that allows dynamic expansion of functions. The AP is a platform that is mainly suitable for ECUs for autonomous driving. The detailed configuration of the ECUs 10 to 40 will be described in detail later. Note that the ECU in this embodiment is not limited to one based on an AP, and may be an ECU based on a platform called a Classic Platform (CP) that optimizes static functions.

The master clock 50 is a clock that has a time synchronized with the outside of the electronic control system 1. For example, the master clock 50 has a time acquired by a receiver of a GPS (Global Positioning System) or a GNSS (Global Navigation Satellite System). Access to the master clock 50 is limited to synchronous master units authorized by the authentication unit 310 described below. Therefore, in order to access the master clock 50, authentication by the authentication unit 310 is required.

The following embodiment is described assuming a centralized mode, in which there is one synchronization master unit that provides time information to each slave unit. However, the following embodiment can also be applied to a distributed mode, in which there are multiple synchronization master units that provide time information to each slave unit.

2. Configuration of ECU 10 The ECU 10 mainly includes an authentication management unit 110 and a synchronization master unit 120. The authentication management unit 110 and the synchronization master unit 120 may each operate on a different virtual machine on the ECU 10. The configurations of the authentication management unit 110 and the synchronization master unit 120 will be described with reference to FIG. 2.

ECU 10 can be configured with a general-purpose CPU, volatile memory such as RAM, non-volatile memory such as ROM, flash memory or a hard disk, various interfaces, and an internal bus connecting these. It can be configured to perform the functions of each functional block shown in FIG. 2 by executing software on this hardware. Of course, each function of ECU 10 may be realized by dedicated hardware such as an LSI. The same applies to the other ECUs described below.

The authentication management unit 110 mainly has the function of managing access from the synchronization master unit 120 to the master clock 50, and blocks access when an unauthenticated synchronization master unit 120 attempts to access the master clock 50. The authentication management unit 110 has an authentication request transmission unit 111, an authentication result reception unit 112, and an authenticated information transmission unit 113. The authentication management unit 110 corresponds to a PEP (Policy Enforcement Point) in the IAM (Identity and Access Management) function.

The authentication request transmission unit 111 requests the authentication unit 310 of the ECU 30, which will be described later, to authenticate access from the synchronization master unit 120 to the master clock 50.

The authentication result receiving unit 112 receives, from the authentication unit 310, the authentication result in response to the authentication request sent by the authentication request sending unit 111. If the authentication result received by the authentication result receiving unit 112 indicates that access to the master clock 50 is permitted, the synchronization master unit 120 is able to access the master clock 50. On the other hand, if the authentication result received by the authentication result receiving unit 112 indicates that access to the master clock 50 is not permitted, the authentication management unit 110 blocks the synchronization master unit 120's access to the master clock 50.

The authenticated information transmission unit 113 transmits "authenticated information" indicating that access from the synchronization master unit 120 to the master clock 50 is permitted to the authentication management unit 210 of the ECU 20 described later. The authenticated information is generated only when the authentication unit 310 permits access from the synchronization master unit 120 to the master clock 50, and is, for example, authority information indicating the right to access the master clock 50. This authority information may be received by the authentication result reception unit 112 from the authentication unit 310 together with the authentication result. As another example, the authenticated information may be a device (ECU) certificate, a user certificate, a password for accessing the master clock 50, a session ID set to a random value, or a private key generated between the synchronization master unit 120 and the master clock 50. Alternatively, the authenticated information may be information used to generate the above-mentioned password, etc.

In this case, "authenticated information" refers not only to information that directly indicates that access has been granted by the authentication unit, but also to information that indirectly indicates that access has been granted, such as a password or key information that can be generated by granting access.

For example, the authenticated information transmission unit 113 periodically transmits the authenticated information to the authentication management unit 210. Alternatively, if an expiration date is set for the password, the session ID, the private key, or the access permission by the authentication unit 310 itself, the authenticated information transmission unit 113 transmits the authenticated information to the authentication management unit 210 each time the expiration date passes and new authenticated information is generated.

As another example, if a software update for the ECU 10 or the synchronization master unit 120 is planned and it is anticipated that the ECU 10 will be "stopped," the authenticated information transmission unit 113 may transmit the authenticated information to the authentication management unit 210 before the ECU 10 is stopped.

Here, "stopping" includes cases where the entire ECU stops functioning, as well as cases where only some of the ECU's functions stop.

The synchronization master unit 120 mainly has the function of providing the slave unit 410 of the ECU 40, which will be described later, with time information that serves as a reference for the slave unit 410. The synchronization master unit 120 includes an internal clock 121, a time information acquisition unit 122, an internal clock control unit 123, a time information transmission unit 124, and a storage unit 125.

The internal clock 121 functions as a clock for the synchronization master unit 120. The internal clock 121 may be a device that measures absolute time, or a device that measures a predetermined interval, such as a counter or an oscillator.

The time information acquisition unit 122 accesses the master clock 50 and "acquires" the reference time of the master clock 50. For example, the time information acquisition unit 122 transmits a reference time request to the master clock 50, requesting the transmission of the reference time. Then, the time information acquisition unit 122 acquires the reference time by receiving a reference time reply including the reference time of the master clock 50 from the master clock 50 as a response to the reference time request.

Here, "obtaining" includes not only obtaining the reference time by receiving it from the master clock, but also obtaining the reference time through calculations using information received from the master clock.

Alternatively, the time information acquisition unit 122 may transmit a reference time request including the current time of the internal clock 121 to the master clock 50. In this case, the time information acquisition unit 122 receives a reference time reply including the differential time between the current time of the internal clock 121 and the reference time of the master clock 50 as a response to the reference time request from the master clock 50. The time information acquisition unit 122 may then acquire the reference time by estimating the reference time held by the master clock 50 based on the current time of the internal clock 121 and the differential time included in the reference time reply transmitted from the master clock 50.

As an alternative method, the time information acquisition unit 122 may acquire the reference time by synchronizing with the master clock 50 using a time synchronization technique based on the IEEE 802.1AS standard or the Precision Time Protocol (PTP) specifications.

The time information acquisition unit 122 can access the master clock 50 to acquire the reference time only if the authentication result receiving unit 112 has received an authentication result indicating access permission from the authentication unit 310.

The internal clock control unit 123 controls the internal clock 121 so that the time of the internal clock 121 becomes the reference time acquired by the time information acquisition unit 122. Therefore, the time of the internal clock 121 becomes equal to the reference time.

The time information transmission unit 124 transmits time information indicating the time of the internal clock 121 to the slave unit 410 of the ECU 40. As described above, the internal clock control unit 123 controls the time of the internal clock 121 to be equal to the reference time acquired by the time information acquisition unit 122. Therefore, the time information transmitted by the time information transmission unit 124 can be said to be time information that "indicates" the reference time. The time information transmitted by the time information transmission unit 124 does not have to be the reference time itself. The synchronization master unit 120 may request the slave unit 410 to transmit the time of the internal clock of the slave unit 410 in advance, and transmit a differential time indicating the difference between the time of the slave unit 410 and the reference time, which is the time of the internal clock 121, to the slave unit 410 as time information. Such a differential time indirectly indicates the reference time. In order to improve the accuracy of the time of the slave unit 410, it is desirable for the time information transmission unit 124 to periodically transmit time information to the slave unit 410.

"Indicate" includes cases where the reference time is directly indicated, as well as cases where the reference time is indirectly indicated.

The storage unit 125 is a volatile memory such as SRAM or DRAM, or a non-volatile memory such as a flash memory or a hard disk, and stores the authenticated information. The authenticated information transmission unit 113 described above acquires the authenticated information stored in the storage unit 125 and transmits it to the authentication management unit 210.

As mentioned above, the ECU 10 is also called the "master device" because it is an electronic control device that provides reference time information to the slave unit 410.

3. Configuration of ECU 20 Like the ECU 10, the ECU 20 includes an authentication management unit 210 and a synchronization master unit 220. The configurations of the authentication management unit 210 and the synchronization master unit 220 will be described with reference to FIG.

The authentication management unit 210 of the ECU 20 includes an authenticated information receiving unit 211. The authenticated information receiving unit 211 receives the "authenticated information" transmitted from the authenticated information transmitting unit 113 of the ECU 10. As described above, the authenticated information is information indicating that access to the master clock 50 is permitted. The authenticated information received by the authenticated information receiving unit 211 is stored in the storage unit 225 described below.

The authentication management unit 210, like the authentication management unit 110, has a function of managing access from the synchronization master unit 220 to the master clock 50. If an unauthenticated synchronization master unit 220 attempts to access the master clock 50, the access is blocked. However, the synchronization master unit 220 itself does not have to be authenticated, and if the authenticated information receiving unit 211 has received authenticated information, the synchronization master unit 220 can access the master clock 50 by using the authenticated information received by the authenticated information receiving unit 211, and in this case, access from the synchronization master unit 220 to the master clock 50 is not blocked.

Like the synchronization master unit 120, the synchronization master unit 220 includes an internal clock 221, a time information acquisition unit 222, an internal clock control unit 223, a time information transmission unit 224, and a storage unit 225, and further includes a stop detection unit 226.

The internal clock 221 functions as a clock for the synchronization master unit 220, and may be something that measures absolute time, or something that measures a specific interval, such as a counter or oscillator.

The time information acquisition unit 222 uses the authenticated information received by the authenticated information receiving unit 211 to access the master clock 50 and "acquire" the reference time of the master clock 50. Like the time information acquisition unit 122, the time information acquisition unit 222 acquires the reference time by sending a reference time request to the master clock 50 and receiving a reference time reply from the master clock 50. However, the time information acquisition unit 222 of the ECU 20 accesses the master clock 50 to acquire the reference time only when the stop detection unit 226 described later detects that the ECU 10 has stopped.

The internal clock control unit 223 controls the internal clock 221 so that the time of the internal clock 221 becomes the reference time acquired by the time information acquisition unit 222.

The time information transmission unit 224 transmits time information indicating the time of the internal clock 221 to the slave unit 410 of the ECU 40.

The storage unit 225 is a volatile memory such as SRAM or DRAM, or a non-volatile memory such as a flash memory or a hard disk, and stores the authenticated information received by the authenticated information receiving unit 211.

The stop detection unit 226 "detects" that the ECU 10 has "stopped." For example, in a configuration in which the authenticated information transmission unit 113 of the ECU 10 periodically transmits authenticated information, if the authenticated information reception unit 211 cannot receive authenticated information, the stop detection unit 226 detects that the function of the authentication management unit 110 of the ECU 10 has stopped. Alternatively, the stop detection unit 226 may detect that the function of the synchronization master unit 120 of the ECU 10 has stopped if it receives a message from the slave unit 410 indicating that it cannot receive time information from the synchronization master unit 120.

"Detection" includes cases where the electronic control device itself detects that the master device has stopped, as well as cases where the electronic control device detects that the master device has stopped by receiving information from another device indicating that the master device has stopped.

As described above, ECU 20 is also called the "backup master device" because it is an electronic control device that can provide reference time information to slave unit 410 in place of ECU 10, which is the master device, when ECU 10 stops.

In this embodiment, the configuration of the ECU 10 required as a master device and the configuration of the ECU 20 required as a backup master device have been described. However, the ECU 10 and the ECU 20 may have the same configuration. For example, the authentication management unit 210 of the ECU 20 may further include an authentication request transmission unit and an authentication result reception unit, similar to the ECU 10, and the synchronization master unit 120 of the ECU 10 may further include a stop detection unit, similar to the ECU 20.

4. Configuration of ECU 30 The ECU 30 includes an authentication unit 310. The authentication unit 310 corresponds to a PDP (Policy Decision Point) in an IAM (Identity and Access Management) function.

When the authentication unit 310 receives an authentication request for access to the master clock 50 from the synchronization master unit 120 from the authentication request transmission unit 111, it performs authentication to determine whether the synchronization master unit 120 can access the master clock 50.

The authentication unit 310 further transmits the authentication result of the access from the synchronization master unit 120 to the master clock 50 to the synchronization master unit 120.

It is desirable to set an expiration date for the access permission from the synchronization master unit 120 to the master clock 50 by the authentication unit 310. By setting an expiration date for the access permission to the master clock 50 and periodically performing authentication by the authentication unit 310, it is possible to prevent, for example, unauthorized access to the master clock 50 from outside the electronic control system 1 via the synchronization master unit 120.

5. Configuration of ECU 40 ECU 40 has a slave unit 410. Slave unit 410 has an internal clock (not shown) and corrects the time indicated by the internal clock in accordance with the time information received from synchronization master unit 120. As a result, the reference time in slave unit 410 becomes the time indicated by the time information received from synchronization master unit 120.

If the slave unit 410 cannot receive time information from the synchronization master unit 120, a discrepancy may occur between the time of the slave unit 410 and the time of the other slave units, and the accuracy of time synchronization may decrease. Therefore, if the slave unit 410 cannot receive time information from the synchronization master unit 120 for a certain period of time, the slave unit 410 transmits a message to the synchronization master unit 220, which has the same function as the synchronization master unit 120, indicating that it cannot receive time information from the synchronization master unit 120. Alternatively, the slave unit 410 may transmit a message to the synchronization master unit 220 requesting time information. When the stop detection unit 226 of the ECU 20 detects that the function of the synchronization master unit 120 has stopped, the slave unit 410 becomes able to receive time information from the synchronization master unit 220 again.

The slave unit 410 is an ECU function that controls the vehicle, such as steering, accelerating, decelerating, and steering. By synchronizing the reference time in the slave unit 410 with the synchronization master unit 120 or the synchronization master unit 220, and thus with the master clock 50, the slave unit 410 can have a time axis that is shared with, for example, a GPS or an on-board sensor. As a result, the slave unit 410 can perform control at the appropriate timing based on the absolute position of the vehicle determined based on information acquired by the GPS or on-board sensor, and the relative position with respect to surrounding objects.

In the present embodiment, the configuration has been described in which only the ECU 40 has the slave unit 410 that receives time information from the synchronization master unit 120 or the synchronization master unit 220. However, the slave unit 410 may be provided in any ECU. For example, each of the ECUs 10 to 30 may have a slave unit, and the synchronization master unit 120 or the synchronization master unit 220 may provide time information to a plurality of slave units 410 provided in these ECUs.
Furthermore, in FIG. 1, the electronic control system 1 is described as having only one ECU 40 having a slave unit 410, but it goes without saying that the electronic control system 1 may have a plurality of ECUs having slave units 410.

6. Operation of Electronic Control System 1 Next, the operation of the electronic control system 1 and each electronic control device of the electronic control system 1 will be described with reference to Figures 4 to 6. Figure 4 is a diagram showing the operation of the entire electronic control system 1. Figure 5 shows the operation of the ECU 10, which is the master device, and Figure 6 shows the operation of the ECU 20, which is the backup master device. The symbols shown in Figure 4 correspond to the symbols shown in Figures 5 and 6, and the same symbols indicate the same processes.

The operation of each electronic control device not only indicates the time information provision method executed by the electronic control device, but also indicates the processing procedure of the time information provision program that can be executed by the electronic control device. Furthermore, these processes are not limited to the order shown in Figures 4 to 6. In other words, the order may be changed as long as there are no constraints, such as a relationship in which a certain step uses the result of the previous step.

First, the operation of the ECU 10 will be mainly described with reference to FIG. 4 and FIG.
In the ECU 10, the authentication request transmission unit 111 of the authentication management unit 110 transmits an authentication request to the authentication unit 310 of the ECU 30, requesting authentication of access from the synchronization master unit 120 to the master clock 50 (S101).

In the ECU 30, when the authentication unit 310 receives the authentication request transmitted from the authentication request transmission unit 111, it performs authentication as to whether or not to permit access from the synchronization master unit 120 to the master clock 50 (S102). Then, the authentication unit 310 transmits the authentication result in S102 to the authentication management unit 110.

The authentication result receiving unit 112 of the authentication management unit 110 receives the authentication result sent from the authentication unit 310 (S103).
Here, if the authentication result received in S103 indicates that access from the synchronization master unit 120 to the master clock 50 is permitted, the time information acquisition unit 122 sends a reference time request requesting the transmission of the reference time (S104).
Then, the time information acquisition unit 122 receives the reference time reply from the master clock 50, thereby acquiring the reference time (S105).
The time information transmitting unit 124 transmits the time information indicating the reference time acquired in S105 to the slave unit 410 (S106).
The authenticated information transmitting unit 113 transmits authenticated information indicating that access from the synchronization master unit 120 to the master clock 50 is permitted to the ECU 20 (S107).

Next, the operation of the ECU 20 will be mainly described with reference to FIG. 4 and FIG.
In the ECU 20, the authenticated information receiving unit 211 of the authentication management unit 210 receives the authenticated information transmitted from the authenticated information transmitting unit 113 in S107 (S200).
When the stop detection unit 226 of the synchronization master unit 220 detects that the ECU 10 has stopped (S201: Yes), the time information acquisition unit 222 transmits a reference time request to the master clock 50 to request transmission of the reference time (S202).
Then, the time information acquisition unit 222 receives the reference time reply from the master clock 50, thereby acquiring the reference time (S203).
The time information transmission unit 224 transmits the time information indicating the reference time acquired in S110 to the slave unit 410 (S204).

The synchronization master unit 120 of the ECU 10 transmits authenticated information indicating that access to the master clock 50 is permitted to the synchronization master unit 220, which functions as a backup for the synchronization master unit 120. As a result, if the ECU 10 stops functioning due to some abnormality or update occurring in the ECU 10 and is no longer able to provide reference time information to the slave unit 410, the backup synchronization master unit 220 can access the master clock 50 to obtain the reference time without being authenticated for access to the master clock 50, and can provide time information indicating the obtained reference time to the slave unit 410.

As described above, according to the configuration of this embodiment, by authenticating access from the synchronization master unit to the master clock, it is possible to prevent unauthorized access to the master clock and ensure security. Furthermore, when a spare synchronization master unit provides time information to a slave unit instead of a synchronization master unit in use, the master clock can be accessed without new authentication by using authenticated information transmitted in advance, thereby shortening the time required to change the synchronization master unit.

7. Summary The features of the electronic control device and the electronic control system including the electronic control device in each embodiment of the present invention have been described above.

The terms used in each embodiment are merely examples and may be replaced with synonymous terms or terms with similar functions.

The block diagrams used to explain the embodiments classify and organize the device configuration by function. The blocks showing each function are realized by any combination of hardware or software. In addition, since they show functions, such block diagrams can also be understood as disclosures of method inventions and program inventions that realize the methods.

The order of the functional blocks that can be understood as processes, flows, and methods described in each embodiment may be changed as long as there are no constraints such as a relationship in which one step uses the results of another step that precedes it.

The terms 1st, 2nd, through Nth (N is an integer) used in each embodiment and in the claims are used to distinguish between two or more configurations or methods of the same type, and do not limit the order or superiority or inferiority.

The electronic control device in each embodiment is assumed to be an electronic control device that is installed in a vehicle, but the electronic control device of the present invention can be applied to any electronic control system, except as specifically limited by the claims.

Examples of the form of the device of the present invention are as follows.
Examples of the component include a semiconductor element, an electronic circuit, a module, and a microcomputer.
Examples of semi-finished products include an electronic control unit (ECU) and a system board.
Finished product forms include mobile phones, smartphones, tablets, personal computers (PCs), workstations, and servers.
Other examples include devices with communication functions, such as video cameras, still cameras, and car navigation systems.

Additionally, necessary functions such as antennas and communication interfaces may be added to each device.

In addition, the present invention can be realized not only by dedicated hardware having the configuration and functions described in each embodiment, but also as a combination of a program for realizing the present invention recorded on a recording medium such as a storage unit or hard disk, and general-purpose hardware having a dedicated or general-purpose CPU and storage unit capable of executing the program.

Programs stored in non-transient, physical recording media (e.g., external storage devices (hard disks, USB storage units, CDs/BDs, etc.) or internal storage devices (RAM, ROM, etc.)) of dedicated or general-purpose hardware can also be provided to the dedicated or general-purpose hardware via the recording media, or via a communication line from a server without using a recording media. This makes it possible to always provide the latest functions through program upgrades.

The electronic control device of the present invention has been described as an on-board electronic control device that is primarily installed in automobiles, but it can also be applied to any moving object, such as motorcycles, ships, trains, and aircraft. It can also be applied to any product that includes a microcomputer, not just moving objects.

1 Electronic control system, 10 Electronic control device, 20 Electronic control device, 50 Master clock, 111 Authentication request transmission unit, 112 Authentication result reception unit, 113 Authenticated information transmission unit, 122, 222 Time information acquisition unit, 124, 224 Time information transmission unit, 211 Authenticated information reception unit, 226 Stop detection unit, 310 Authentication unit, 410 Slave unit

Claims (12)

An electronic control device that provides reference time information to a slave unit (410),
an authentication request transmission unit (111) for requesting an authentication unit (310) for authentication of access to a master clock (50) having a reference time;
an authentication result receiving unit (112) that receives an authentication result of access to the master clock from the authentication unit;
a time information acquisition unit (122) that accesses the master clock and acquires the reference time when access to the master clock is permitted by the authentication unit;
a time information transmission unit (124) that transmits the time information indicating the reference time to the slave unit;
an authenticated information transmitting unit (113) for transmitting authenticated information enabling an access from a standby master device (20) connected to the electronic control device to the standby master device ;
Equipped with
the standby master device is a device capable of transmitting the time information to the slave unit in place of the electronic control device;
An electronic control device (10). An electronic control device that provides reference time information to a slave unit (410),
an authenticated information receiving unit (211) for receiving authenticated information enabling access from the electronic control unit to a master clock (50) having a reference time from a master device (10) that transmits the time information to the slave unit;
A stop detection unit (226) for detecting that the master device has stopped;
a time information acquisition unit (222) that, when the stop detection unit detects a stop of the master device, accesses the master clock using the authenticated information to acquire the reference time;
a time information transmission unit (224) that transmits the time information indicating the reference time to the slave unit;
An electronic control device (20). the authenticated information transmission unit periodically transmits the authenticated information to the backup master device.
2. The electronic control device according to claim 1. the authenticated information transmission unit transmits the authenticated information to the standby master device before the electronic control device is stopped;
2. The electronic control device according to claim 1. the authenticated information receiving unit periodically receives the authenticated information from the master device,
the stop detection unit detects a stop of the master device when the authenticated information cannot be received from the master device.
3. The electronic control device according to claim 2. the slave unit transmits a message to the electronic control unit when the slave unit cannot receive the time information from the master device;
the stop detection unit detects a stop of the master device when the message is received from the slave unit.
3. The electronic control device according to claim 2. the authenticated information is a password for accessing the master clock;
3. The electronic control device according to claim 1 or 2. The electronic control device is a device mounted on a moving body.
8. An electronic control device according to claim 1. A time information providing program executable by an electronic control device that provides reference time information to a slave unit (410),
A request is made to the authentication unit (310) for authentication of access to a master clock (50) having a reference time (S101);
Receive an authentication result for access to the master clock from the authentication unit (S103);
If the authentication unit is permitted to access the master clock, the master clock is accessed to obtain the reference time (S104, S105).
The time information indicating the reference time is transmitted to the slave unit (S106).
transmits, to a standby master device (20) capable of transmitting the time information to the slave unit instead of the electronic control device, authenticated information enabling the standby master device to access the master clock (S107);
A time information providing program. A time information providing program executable by an electronic control device that provides reference time information to a slave unit (410),
receiving, from a master device (10) that transmits the time information to the slave unit, authentication information that enables the electronic control device to access a master clock (50) having a reference time (S200);
A stop detection unit detects that the master device has stopped (S201);
When the stop detection unit detects a stop of the master device, the master clock is accessed using the authenticated information to obtain the reference time (S202, S203).
The time information indicating the reference time is transmitted to the slave unit (S204).
A time information providing program. An electronic control system having a first electronic control unit (10) and a second electronic control unit (20) that provide reference time information to a slave unit (410),
The first electronic control unit includes:
an authentication request transmission unit (111) for requesting an authentication unit (310) for authentication of access to a master clock (50) having a reference time;
an authentication result receiving unit (112) that receives an authentication result of access to the master clock from the authentication unit;
a time information acquisition unit (122) that accesses the master clock and acquires the reference time when access to the master clock is permitted by the authentication unit;
a time information transmission unit (124) that transmits the time information indicating the reference time to the slave unit;
an authenticated information transmitting unit (113) for transmitting authenticated information enabling the second electronic control unit (20) to access the master clock;
Equipped with
The second electronic control unit includes:
an authenticated information receiving unit (211) that receives the authenticated information from the first electronic control device;
A stop detection unit (226) that detects that the first electronic control device has stopped;
a time information acquisition unit (222) that, when the stop detection unit detects a stop of the first electronic control unit, accesses the master clock using the authenticated information to acquire the reference time;
a time information transmission unit (224) that transmits the time information indicating the reference time to the slave unit;
An electronic control system (1). A time information providing method executed in an electronic control system (1) having a first electronic control unit (10) and a second electronic control unit (20) that provide reference time information to a slave unit (410), comprising:
In the first electronic control device,
requesting an authentication unit (310) for authentication of access to a master clock (50) having a reference time;
receiving an authentication result of access to the master clock from the authentication unit;
if the authentication unit is permitted to access the master clock, the master clock is accessed to obtain the reference time;
transmitting the time information indicating the reference time to the slave unit;
transmitting authentication information to the second electronic control unit that enables the second electronic control unit to access the master clock;
In the second electronic control device,
receiving the authenticated information from the first electronic control device;
A stop detection unit detects that the first electronic control unit has stopped,
When the stop detection unit detects a stop of the first electronic control unit, the stop detection unit accesses the master clock using the authenticated information to obtain the reference time;
transmitting the time information indicating the reference time to the slave unit;
Method of providing time information.