Method for confirming correction program and information processing apparatus

• US 10,157,050 B2
• Filed: 09/24/2014
• Issued: 12/18/2018
• Est. Priority Date: 10/18/2013
• Status: Active Grant

• Current Assignee: Fujitsu Limited, Toyota Jidosha Kabushiki Kaisha (Toyota Motor Corporation)
• Original Assignee: Fujitsu Limited, Toyota Jidosha Kabushiki Kaisha (Toyota Motor Corporation)
• Inventors: Kotani, Seigo, Suzuki, Masato, Oguma, Hisashi
• Primary Examiner(s): Das, Chameli
• Assistant Examiner(s): MACASIANO, JOANNE GONZALES
• Application Number:
  US14/495,195
• Publication Number:
  US 20150113520A1
• Time in Patent Office: 1,546 Days
• CPC Class Codes: G06F 11/1433 during software upgrading
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57
• CPC Class Codes: G06F 8/654 using techniques specially adapted for alterable solid state memories, e.g. for EEPROM or flash memories

Abstract

A method includes receiving first information that is information on a control program from a control unit which executes the control program for controlling equipment loaded onto an automobile, the control unit being loaded onto the automobile, calculating second information that is a state of the control program when applying a correction program on the control program to the control unit on the basis of the received first information, transmitting the correction program to the control unit, receiving from the control unit third information that is information on a state of the control program after applying the transmitted correction program to the control unit, comparing the received third information with the calculated second information, and judging whether or not processing of applying the correction program to the control unit has succeeded on the basis of a result of the comparison.

Claims

1. A method for confirming a correction program executed by a computer, the method comprising:

receiving, by the computer, first information that includes a value for confirmation of authenticity and a version identity of a control program from a control unit, the control unit being loaded onto the automobile, the control program being held by each of a plurality of equipment connected to the control unit via a network or a bus;

selecting, by the computer from among a plurality of control programs based on the first information, a first correction target control program, for which at least one of the authenticity and the version identity is not maintained, and a second correction target control program that defines an output value from the correction target control program as input;

determining, by the computer based on the first information and the first and second correction target control programs, correction programs to be applied to the first and second correction target control programs;

calculating, by the computer, second information that includes a first set of hash values respectively calculated from the control programs when the correction programs have been applied respectively to the first and second correction target control programs held by each of the plurality of equipment;

transmitting, by the computer, the correction target control programs to the control unit;

receiving, by the computer, from the control unit, third information that includes a second set of hash values respectively calculated from the correction target control programs after applying the correction programs to the first and second correction target control programs held by each of the plurality of equipment;

comparing, by the computer, the second set of hash values included in the third information with the first set of hash values included in the second information for the correction target control programs;

judging, by the computer in accordance with a result of the comparing, that the applying of the correction programs to the first and second target control programs has succeeded when all of the second set of hash values match all of the first set of hash values, or when a first subset of the first set of hash values that correspond to travel target control programs that affect travel by the automobile match a second subset of the second set of hash values that correspond to the travel target control programs;

transmitting, by the computer, to the control unit an instruction to validate each of the first and second target control programs to which the correction programs have been applied, when the applying of the correction programs to the first and second target control programs has succeeded; and

transmitting, by the computer, to the control unit an instruction to roll back the applying of the correction programs, when the applying of any of the correction programs to the first and second target control programs has failed.

2. The method according to claim 1, wherein the first information and the third information are prepared by software for which authenticity is confirmed.

3. The method according to claim 2, wherein the first information and the third information are prepared by the software for which authenticity is confirmed by a function loaded onto a Trusted Platform Module.

4. The method according to claim 1, the method further comprising:

transmitting to the control unit an instruction to validate updated control programs to which the correction target control programs have been applied, when the applying of the correction target control programs to each of the plurality of equipment has succeeded.

5. The method for confirming a correction program executed by a computer according to claim 1,

further comprising deciding whether a state of the control program is normal based on the first information, and

wherein the transmitting includes transmitting the correction target control programs to each of the plurality of equipment when the state of the control program is normal.

6. A non-transitory computer-readable recording medium having stored therein a program for confirming a correction program for causing a computer to execute a process, the process comprising:

receiving first information that includes a value for confirmation of authenticity and a version identity of a control program from a control unit, the control unit being loaded onto the automobile, the control program being held by each of a plurality of equipment connected to the control unit via a network or a bus;

selecting, by the computer from among a plurality of control programs based on the first information, a first correction target control program, for which at least one of the authenticity and the version identity is not maintained, and a second correction target control program that defines an output value from the correction target control program as input;

determining, by the computer based on the first information and the first and second correction target control programs, correction programs to be applied to the first and second correction target control programs;

calculating second information that includes a first set of hash values respectively calculated from the control programs when the correction programs have been applied respectively to the first and second correction target control programs held by each of the plurality of equipment;

transmitting the correction target control programs to the control unit;

receiving from the control unit, third information that includes a second set of hash values respectively calculated from the correction target control programs after applying the correction programs to the first and second correction target control programs held by each of the plurality of equipment;

comparing the second set of hash values included in the third information with the first set of hash values included in the second information for the correction target control programs;

judging, in accordance with a result of the comparing, that the applying of the correction programs to the first and second target control programs has succeeded when all of the second set of hash values match all of the first set of hash values, or when a first subset of the first set of hash values that correspond to travel target control programs that affect travel by the automobile match a second subset of the second set of hash values that correspond to the travel target control programs; and

rolling back application of the correction programs, when the applying of any of the correction programs to the first and second target control programs has failed.

7. The non-transitory computer-readable recording medium according to claim 6, wherein the first information and the third information are prepared by software for which authenticity is confirmed.

8. The non-transitory computer-readable recording medium according to claim 7, wherein the first information and the third information are prepared by the software for which authenticity is confirmed by a function loaded into a Trusted Platform Module.

9. The non-transitory computer-readable recording medium according to claim 6, the process further comprising:

transmitting to the control unit an instruction to validate updated control programs to which the correction target control programs have been applied, when the applying of the correction target control programs to each of the plurality of equipment has succeeded.

10. An information processing apparatus, connectable to a control unit in an automobile, the control unit connected to each of a plurality of equipment in the automobile via at least one of a network and a bus, the information processing apparatus comprising:

a processor configured

to receive first information that includes a value for confirmation of authenticity and a version identity of a control program from the control unit of the automobile;

to select from among the plurality of control programs based on the first information a first correction target control program, for which at least one of the authenticity and the version identity is not maintained, and a second correction target control program that defines an output value from the correction target control program as input;

to determine, based on the first information and the first and second correction target control programs, correction programs to be applied to the first and second correction target control programs;

to calculate second information that includes a first set of hash values respectively calculated from the control programs when the correction programs have been applied respectively to the first and second correction target control programs held by each of the plurality of equipment;

to transmit the correction target control programs to the control unit;

to receive from the control unit third information that includes a second set of hash values respectively calculated from the correction target control programs after applying the correction programs to the first and second correction target control programs to each of the plurality of equipment;

to compare the second set of hash values included in the third information with the first set of hash values included in the second information for the correction target control programs and obtain a comparison result;

to judge, in accordance with the comparison result, that the applying of the correction programs to the first and second target control programs has succeeded when all of the second set of hash values match all of the first set of hash values, or when a first subset of the first set of hash values that correspond to travel target control programs that affect travel by the automobile match a second subset of the second set of hash values that correspond to the travel target control programs; and

to roll back application of the correction programs, when the application of any of the correction programs to the first and second target control programs has failed.

11. The information processing apparatus according to claim 10, wherein the first information and the third information are prepared by software for which authenticity is confirmed.

12. The information processing apparatus according to claim 11, wherein the first information and the third information are prepared by the software for which authenticity is confirmed by a function loaded into a Trusted Platform Module.

13. The information processing apparatus according to claim 10, wherein the processor is further configured to transmit an instruction to validate updated control programs to which the correction target control programs have been applied, when the application of the correction target control programs to each of the plurality of equipment has succeeded.