Gateway device, in-vehicle network system, and firmware update method

• US 10,725,762 B2
• Filed: 03/22/2017
• Issued: 07/28/2020
• Est. Priority Date: 09/14/2015
• Status: Active Grant

• Current Assignee: Panasonic Intellectual Property Corporation of America (Panasonic Holdings Corporation)
• Original Assignee: Panasonic Intellectual Property Corporation of America (Panasonic Holdings Corporation)
• Inventors: Ujiie, Yoshihiro, Matsushima, Hideki, Anzai, Jun, Nakano, Toshihisa, Haga, Tomoyuki, Maeda, Manabu, Kishikawa, Takeshi
• Primary Examiner(s): Wai, Eric C
• Application Number:
  US15/465,653
• Publication Number:
  US 20170192770A1
• Time in Patent Office: 1,224 Days
• CPC Class Codes: B60R 16/02 electric constitutive elements
• CPC Class Codes: B60R 16/023 for transmission of signals between vehicle parts or subsystems
• CPC Class Codes: G06F 11/00 Error detection; Error correction; Monitoring error detection, correction or monitoring in information storage based on relative movement between record carrier and transducer G11B20/18; monitoring, i.e. supervising the progress of recording or reproducing G11B27/36; in static stores G11C29/00
• CPC Class Codes: G06F 11/1433 during software upgrading
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06F 2201/83 the solution involving signatures
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57
• CPC Class Codes: G06F 8/654 using techniques specially adapted for alterable solid state memories, e.g. for EEPROM or flash memories
• CPC Class Codes: H04L 12/40006 Architecture of a communication node current supply arrangements H04L12/10; intermediate storage or scheduling H04L49/90
• CPC Class Codes: H04L 12/4625 Single bridge functionality, e.g. connection of two networks over a single bridge
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04W 4/48 for in-vehicle communication

Abstract

A gateway device, connected to one or more buses used in communication by a plurality of ECUs on-board a vehicle, is provided with: a receiving unit that receives, from a server that acts as an external device external to the vehicle, firmware update information that includes updated firmware to be applied to one ECU from among the plurality of ECUs; and a control unit that determines, based on certain information about the ECU on which to apply the updated firmware, whether or not the ECU satisfies a certain condition, and if the certain condition is satisfied, causes the ECU to execute a certain process related to updating firmware, whereas if the certain condition is not satisfied, causes equipment other than the ECU to execute the certain process.

Claims

1. A gateway device connected via one or more buses to a plurality of electronic controllers on-board a vehicle, the gateway device comprising:

one or more memories; and

circuitry, that in operation,

receives firmware update information from an external device external to the vehicle, the firmware update information including updated firmware to be applied to a first electronic controller from among the plurality of electronic controllers on-board the vehicle,

determines, by accessing the one or more memories, whether or not the first electronic controller satisfies a first condition and a second condition, based on first information and second information, respectively, about the first electronic controller, wherein the first information is whether the first electronic controller is capable of performing a signature verification operation, which is determined prior to transmittal of the updated firmware, and the second information is whether the first electronic controller includes a firmware cache for performing a pre-update firmware cache operation,

causes, when the first condition is determined to be satisfied, the first electronic controller to execute a first process related to updating the firmware of the first electronic controller,

causes, when the first condition is determined not to be satisfied, a first device on-board the vehicle, other than the first electronic controller, to execute the first process related to updating the firmware of the first electronic controller by proxy, and

causes, when the second information indicates that the first electronic controller does not include a firmware cache for performing a pre-update firmware cache operation, the gateway device to execute a proxy process,

wherein the gateway device requests the first electronic controller to transmit boot ROM data to the gateway device, creates updated boot ROM data with the updated firmware, and transmits the updated boot ROM data to the first electronic controller that updates the boot ROM and resets the first electronic controller with the updated firmware.

2. The gateway device according to claim 1,

wherein the first information indicates a processing capability of the first electronic controller.

3. The gateway device according to claim 1,

wherein the first information indicates whether or not the first electronic controller includes a function of executing the first process, and

in the determining, the first condition is determined to be satisfied when the first electronic controller includes the function of executing the first process, and the first condition is determined not to be satisfied when the first electronic controller does not include the function of executing the first process.

4. The gateway device according to claim 1,

wherein the firmware update information includes a signature attached to the updated firmware, and

the first process is a process of verifying the signature.

5. The gateway device according to claim 1,

wherein the first process is a process of saving pre-update firmware held by the first electronic controller.

6. The gateway device according to claim 1,

wherein when the first condition is determined not to be satisfied, the circuitry selects, as the first device, a second electronic controller other than the first electronic controller from among the plurality of electronic controllers.

7. The gateway device according to claim 1,

wherein when the first condition is determined not to be satisfied, the circuitry selects the gateway device as the first device.

8. The gateway device according to claim 4,

wherein when the first condition is determined not to be satisfied, the circuitry selects, as the first device, an electronic controller that is other than the first electronic controller and that includes a key to use for verifying the signature from among the plurality of electronic controllers.

9. The gateway device according to claim 1,

wherein the plurality of electronic controllers communicate over the one or more buses in accordance with a controller area network (CAN) protocol.

10. An in-vehicle network system provided with a plurality of electronic controllers on-board a vehicle that communicate over one or more buses, and a gateway device connected to the one or more buses, the gateway device comprising:

one or more memories; and

circuitry, that in operation,

receives firmware update information from an external device external to the vehicle in which the gateway device is installed on-board, the firmware update information including updated firmware to be applied to a first electronic controller from among the plurality of electronic controllers on-board the vehicle,

determines, by accessing the one or more memories, whether or not the first electronic controller satisfies a first condition and a second condition, based on first information and second information, respectively, about the first electronic controller, wherein the first information is whether the first electronic controller is capable of performing a signature verification operation, which is determined prior to transmittal of the updated firmware, and the second information is whether the first electronic controller includes a firmware cache for performing a pre-update firmware cache operation,

causes, when the first condition is determined to be satisfied, the first electronic controller to execute a first process related to updating the firmware of the first electronic controller,

causes, when the first condition is determined not to be satisfied, a first device on-board the vehicle, other than the first electronic controller, to execute the first process related to updating the firmware of the first electronic controller by proxy, and

causes, when the second information indicates that the first electronic controller does not include a firmware cache for performing a pre-update firmware cache operation, the gateway device to execute a proxy process,

wherein the gateway device requests the first electronic controller to transmit boot ROM data to the gateway device, creates updated boot ROM data with the updated firmware, and transmits the updated boot ROM data to the first electronic controller that updates the boot ROM and resets the first electronic controller with the updated firmware.

11. A method used in an in-vehicle network system provided with a plurality of electronic controllers on-board a vehicle that communicate over one or more buses, the method comprising:

receiving firmware update information from an external device external to the vehicle in which the plurality of electronic controllers is installed on-board the vehicle, the firmware update information including updated firmware to be applied to a first electronic controller from among the plurality of electronic controllers;

determining, by accessing the one or more memories, whether or not the first electronic controller satisfies a first condition and a second condition, based on first information and second information, respectively, about the first electronic controller, wherein the first information is whether the first electronic controller is capable of performing a signature verification operation, which is determined prior to transmittal of the updated firmware, and the second information is whether the first electronic controller includes a firmware cache for performing a pre-update firmware cache operation;

causing, when the first condition is determined to be satisfied, the first electronic controller to execute a first process related to updating the firmware of the first electronic controller;

causing, when the first condition is determined not to be satisfied, a first device on-board the vehicle, other than the first electronic controller, to execute the first process related to updating the firmware of the first electronic controller by proxy; and

causing, when the second information indicates that the first electronic controller does not include a firmware cache for performing a pre-update firmware cache operation, the gateway device to execute a proxy process,

wherein the gateway device requests the first electronic controller to transmit boot ROM data to the gateway device, creates updated boot ROM data with the updated firmware, and transmits the updated boot ROM data to the first electronic controller that updates the boot ROM and resets the first electronic controller with the updated firmware.